# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jun 6 2019 12:21:16 # Log Creation Date: 21.06.2019 19:01:32.490 Process: id = "1" image_name = "greencrypt_crypt.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\greencrypt_crypt.exe" page_root = "0x4dcc3000" os_pid = "0x978" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x97c [0033.708] SetErrorMode (uMode=0x8001) returned 0x0 [0033.715] GetVersion () returned 0x1db10106 [0033.716] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76c20000 [0033.716] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0033.717] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0033.717] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\UXTHEME.dll") returned 12 [0033.717] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\UXTHEME.dll", hFile=0x0, dwFlags=0x8) returned 0x745d0000 [0034.046] lstrlenA (lpString="UXTHEME") returned 7 [0034.046] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0034.046] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\USERENV.dll") returned 12 [0034.047] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\USERENV.dll", hFile=0x0, dwFlags=0x8) returned 0x74ac0000 [0034.306] lstrlenA (lpString="USERENV") returned 7 [0034.306] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0034.306] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\SETUPAPI.dll") returned 13 [0034.306] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\SETUPAPI.dll", hFile=0x0, dwFlags=0x8) returned 0x75c00000 [0035.434] lstrlenA (lpString="SETUPAPI") returned 8 [0035.434] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0035.434] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\APPHELP.dll") returned 12 [0035.434] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\APPHELP.dll", hFile=0x0, dwFlags=0x8) returned 0x74a60000 [0035.646] lstrlenA (lpString="APPHELP") returned 7 [0035.646] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0035.646] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\PROPSYS.dll") returned 12 [0035.646] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\PROPSYS.dll", hFile=0x0, dwFlags=0x8) returned 0x74960000 [0035.937] lstrlenA (lpString="PROPSYS") returned 7 [0035.938] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0035.938] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\DWMAPI.dll") returned 11 [0035.938] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\DWMAPI.dll", hFile=0x0, dwFlags=0x8) returned 0x745b0000 [0036.334] lstrlenA (lpString="DWMAPI") returned 6 [0036.334] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.334] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\CRYPTBASE.dll") returned 14 [0036.334] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\CRYPTBASE.dll", hFile=0x0, dwFlags=0x8) returned 0x74c80000 [0036.335] lstrlenA (lpString="CRYPTBASE") returned 9 [0036.335] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.335] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\OLEACC.dll") returned 11 [0036.335] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\OLEACC.dll", hFile=0x0, dwFlags=0x8) returned 0x74920000 [0036.656] lstrlenA (lpString="OLEACC") returned 6 [0036.656] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.656] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\CLBCATQ.dll") returned 12 [0036.656] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\CLBCATQ.dll", hFile=0x0, dwFlags=0x8) returned 0x752b0000 [0036.959] lstrlenA (lpString="CLBCATQ") returned 7 [0036.959] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0036.959] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\NTMARTA.dll") returned 12 [0036.959] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\NTMARTA.dll", hFile=0x0, dwFlags=0x8) returned 0x748f0000 [0037.201] lstrlenA (lpString="NTMARTA") returned 7 [0037.201] GetModuleHandleA (lpModuleName="VERSION") returned 0x0 [0037.201] GetSystemDirectoryA (in: lpBuffer=0x18fcc0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0037.201] wsprintfA (in: param_1=0x18fcd3, param_2="%s%s.dll" | out: param_1="\\VERSION.dll") returned 12 [0037.201] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\VERSION.dll", hFile=0x0, dwFlags=0x8) returned 0x748e0000 [0037.272] GetProcAddress (hModule=0x748e0000, lpProcName="GetFileVersionInfoA") returned 0x748e1ced [0037.272] GetModuleHandleA (lpModuleName="SHFOLDER") returned 0x0 [0037.272] GetSystemDirectoryA (in: lpBuffer=0x18fcc0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0037.272] wsprintfA (in: param_1=0x18fcd3, param_2="%s%s.dll" | out: param_1="\\SHFOLDER.dll") returned 13 [0037.272] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\SHFOLDER.dll", hFile=0x0, dwFlags=0x8) returned 0x748d0000 [0037.294] GetProcAddress (hModule=0x748d0000, lpProcName="SHGetFolderPathA") returned 0x748d1528 [0037.294] GetModuleHandleA (lpModuleName="SHLWAPI") returned 0x75340000 [0037.295] GetProcAddress (hModule=0x75340000, lpProcName=0x1b5) returned 0x7535bee6 [0037.295] IsOS (dwOS=0x1e) returned 1 [0037.295] InitCommonControls () [0037.295] OleInitialize (pvReserved=0x0) returned 0x0 [0037.304] SHGetFileInfoA (in: pszPath="", dwFileAttributes=0x0, psfi=0x18fe2c, cbFileInfo=0x160, uFlags=0x0 | out: psfi=0x18fe2c) returned 0x1 [0038.030] lstrcpynA (in: lpString1=0x423f20, lpString2="NSIS Error", iMaxLength=1024 | out: lpString1="NSIS Error") returned="NSIS Error" [0038.031] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe\" " [0038.031] lstrcpynA (in: lpString1=0x42a000, lpString2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe\" ", iMaxLength=1024 | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe\" ") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe\" " [0038.032] GetTempPathA (in: nBufferLength=0x400, lpBuffer=0x42b400 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.037] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.037] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.037] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0038.037] GetLastError () returned 0xb7 [0038.037] GetTickCount () returned 0x19645 [0038.037] GetTempFileNameA (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="nsx", uUnique=0x0, lpTempFileName=0x42b000 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsx9655.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsx9655.tmp")) returned 0x9655 [0038.040] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsx9655.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsx9655.tmp")) returned 1 [0038.041] GetTickCount () returned 0x19655 [0038.041] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x42bc00, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\greencrypt_crypt.exe")) returned 0x3a [0038.041] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\greencrypt_crypt.exe")) returned 0x20 [0038.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\greencrypt_crypt.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x15c [0038.041] lstrcpynA (in: lpString1=0x42ac00, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe" [0038.041] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe") returned 58 [0038.042] lstrcpynA (in: lpString1=0x42c000, lpString2="greencrypt_crypt.exe", iMaxLength=1024 | out: lpString1="greencrypt_crypt.exe") returned="greencrypt_crypt.exe" [0038.042] GetFileSize (in: hFile=0x15c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3cf11 [0038.042] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.043] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.044] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.045] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x200, lpOverlapped=0x0) returned 1 [0038.046] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x8000, lpOverlapped=0x0) returned 1 [0038.047] GetTickCount () returned 0x19655 [0038.047] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x8000, lpOverlapped=0x0) returned 1 [0038.048] GetTickCount () returned 0x19655 [0038.048] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x8000, lpOverlapped=0x0) returned 1 [0038.048] GetTickCount () returned 0x19655 [0038.048] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x8000, lpOverlapped=0x0) returned 1 [0038.048] GetTickCount () returned 0x19655 [0038.048] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x8000, lpOverlapped=0x0) returned 1 [0038.049] GetTickCount () returned 0x19655 [0038.049] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x8000, lpOverlapped=0x0) returned 1 [0038.049] GetTickCount () returned 0x19655 [0038.049] ReadFile (in: hFile=0x15c, lpBuffer=0x4178f0, nNumberOfBytesToRead=0x410d, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x4178f0*, lpNumberOfBytesRead=0x18fca8*=0x410d, lpOverlapped=0x0) returned 1 [0038.049] GetTickCount () returned 0x19655 [0038.049] SetFilePointer (in: hFile=0x15c, lDistanceToMove=249613, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cf0d [0038.049] ReadFile (in: hFile=0x15c, lpBuffer=0x18fdf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fca8, lpOverlapped=0x0 | out: lpBuffer=0x18fdf4*, lpNumberOfBytesRead=0x18fca8*=0x4, lpOverlapped=0x0) returned 1 [0038.050] GetTickCount () returned 0x19655 [0038.050] GetTempFileNameA (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="nsn", uUnique=0x0, lpTempFileName=0x18fcc4 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsn9656.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsn9656.tmp")) returned 0x9656 [0038.050] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsn9656.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsn9656.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x4000100, hTemplateFile=0x0) returned 0x158 [0038.051] SetFilePointer (in: hFile=0x15c, lDistanceToMove=35868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c1c [0038.051] GetTickCount () returned 0x19655 [0038.051] SetFilePointer (in: hFile=0x15c, lDistanceToMove=35868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c1c [0038.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.051] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fc6c, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fc6c*=0x4000, lpOverlapped=0x0) returned 1 [0038.155] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x18fc78, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fc78*=0x8000, lpOverlapped=0x0) returned 1 [0038.157] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x1ad7, lpNumberOfBytesWritten=0x18fc78, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fc78*=0x1ad7, lpOverlapped=0x0) returned 1 [0038.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.157] ReadFile (in: hFile=0x158, lpBuffer=0x18fca8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fc90, lpOverlapped=0x0 | out: lpBuffer=0x18fca8*, lpNumberOfBytesRead=0x18fc90*=0x4, lpOverlapped=0x0) returned 1 [0038.157] GetTickCount () returned 0x196c2 [0038.157] ReadFile (in: hFile=0x158, lpBuffer=0x601e10, nNumberOfBytesToRead=0x1dcb, lpNumberOfBytesRead=0x18fc9c, lpOverlapped=0x0 | out: lpBuffer=0x601e10*, lpNumberOfBytesRead=0x18fc9c*=0x1dcb, lpOverlapped=0x0) returned 1 [0038.158] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76c20000 [0038.158] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultUILanguage") returned 0x76c344ab [0038.158] GetUserDefaultUILanguage () returned 0x409 [0038.158] wsprintfA (in: param_1=0x42b000, param_2="%d" | out: param_1="1033") returned 4 [0038.158] wsprintfA (in: param_1=0x42b000, param_2="%d" | out: param_1="1033") returned 4 [0038.158] lstrlenA (lpString="zibet") returned 5 [0038.158] lstrcpynA (in: lpString1=0x423f20, lpString2="zibet Setup", iMaxLength=1024 | out: lpString1="zibet Setup") returned="zibet Setup" [0038.158] SetWindowTextA (hWnd=0x0, lpString="zibet Setup") returned 0 [0038.158] lstrcpynA (in: lpString1=0x602054, lpString2="hippophiles", iMaxLength=1024 | out: lpString1="hippophiles") returned="hippophiles" [0038.158] lstrcpynA (in: lpString1=0x60246c, lpString2="pluck", iMaxLength=1024 | out: lpString1="pluck") returned="pluck" [0038.158] lstrcpynA (in: lpString1=0x602884, lpString2="intricacieschabazitedwarf", iMaxLength=1024 | out: lpString1="intricacieschabazitedwarf") returned="intricacieschabazitedwarf" [0038.158] lstrcpynA (in: lpString1=0x422138, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.158] lstrcpynA (in: lpString1=0x422138, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.158] lstrcpynA (in: lpString1=0x42a400, lpString2="C:\\Program files\\Trillian", iMaxLength=1024 | out: lpString1="C:\\Program files\\Trillian") returned="C:\\Program files\\Trillian" [0038.159] LoadImageA (hInst=0x400000, name=0x67, type=0x1, cx=0, cy=0, fuLoad=0x8040) returned 0xb012f [0038.160] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.160] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.160] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.160] CreateDirectoryA (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0038.160] GetLastError () returned 0xb7 [0038.160] GetFileAttributesA (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0038.160] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1"), lpSecurityAttributes=0x0) returned 0 [0038.161] GetLastError () returned 0xb7 [0038.161] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1")) returned 0x10 [0038.161] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata"), lpSecurityAttributes=0x0) returned 0 [0038.161] GetLastError () returned 0xb7 [0038.161] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata")) returned 0x2012 [0038.161] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local"), lpSecurityAttributes=0x0) returned 0 [0038.161] GetLastError () returned 0xb7 [0038.161] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local")) returned 0x2010 [0038.161] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0038.161] GetLastError () returned 0xb7 [0038.161] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0038.161] lstrcpynA (in: lpString1=0x42a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.161] SetCurrentDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 1 [0038.161] lstrcpynA (in: lpString1=0x40b000, lpString2="InAppPickerConfirmationControl.xbf", iMaxLength=1024 | out: lpString1="InAppPickerConfirmationControl.xbf") returned="InAppPickerConfirmationControl.xbf" [0038.161] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.161] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.161] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.162] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="InAppPickerConfirmationControl.xbf" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\InAppPickerConfirmationControl.xbf") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\InAppPickerConfirmationControl.xbf" [0038.162] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\InAppPickerConfirmationControl.xbf" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\inapppickerconfirmationcontrol.xbf")) returned 0xffffffff [0038.162] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\InAppPickerConfirmationControl.xbf" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\inapppickerconfirmationcontrol.xbf")) returned 0xffffffff [0038.162] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\InAppPickerConfirmationControl.xbf" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\inapppickerconfirmationcontrol.xbf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0038.163] SetFilePointer (in: hFile=0x158, lDistanceToMove=23511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5bd7 [0038.163] GetTickCount () returned 0x196d2 [0038.163] ReadFile (in: hFile=0x158, lpBuffer=0x18fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x18fbcc*, lpNumberOfBytesRead=0x18fbb4*=0x4, lpOverlapped=0x0) returned 1 [0038.163] GetTickCount () returned 0x196d2 [0038.163] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0xad3, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0xad3, lpOverlapped=0x0) returned 1 [0038.163] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0xad3, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0xad3, lpOverlapped=0x0) returned 1 [0038.164] SetFileTime (hFile=0x1c, lpCreationTime=0x18fd94, lpLastAccessTime=0x0, lpLastWriteTime=0x18fd94) returned 1 [0038.164] CloseHandle (hObject=0x1c) returned 1 [0038.165] lstrcpynA (in: lpString1=0x40b000, lpString2="Animate_loop.64.png", iMaxLength=1024 | out: lpString1="Animate_loop.64.png") returned="Animate_loop.64.png" [0038.165] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.165] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.165] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.165] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="Animate_loop.64.png" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Animate_loop.64.png") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Animate_loop.64.png" [0038.165] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Animate_loop.64.png" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\animate_loop.64.png")) returned 0xffffffff [0038.165] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Animate_loop.64.png" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\animate_loop.64.png")) returned 0xffffffff [0038.165] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Animate_loop.64.png" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\animate_loop.64.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0038.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=26286, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66ae [0038.166] GetTickCount () returned 0x196d2 [0038.166] ReadFile (in: hFile=0x158, lpBuffer=0x18fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x18fbcc*, lpNumberOfBytesRead=0x18fbb4*=0x4, lpOverlapped=0x0) returned 1 [0038.166] GetTickCount () returned 0x196d2 [0038.166] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x873, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x873, lpOverlapped=0x0) returned 1 [0038.166] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x873, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x873, lpOverlapped=0x0) returned 1 [0038.167] SetFileTime (hFile=0x1c, lpCreationTime=0x18fd94, lpLastAccessTime=0x0, lpLastWriteTime=0x18fd94) returned 1 [0038.167] CloseHandle (hObject=0x1c) returned 1 [0038.167] lstrcpynA (in: lpString1=0x40b000, lpString2="config.def", iMaxLength=1024 | out: lpString1="config.def") returned="config.def" [0038.167] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.168] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.168] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.168] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="config.def" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\config.def") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\config.def" [0038.168] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\config.def" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\config.def")) returned 0xffffffff [0038.168] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\config.def" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\config.def")) returned 0xffffffff [0038.168] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\config.def" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\config.def"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0038.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=28453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f25 [0038.168] GetTickCount () returned 0x196d2 [0038.168] ReadFile (in: hFile=0x158, lpBuffer=0x18fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x18fbcc*, lpNumberOfBytesRead=0x18fbb4*=0x4, lpOverlapped=0x0) returned 1 [0038.168] GetTickCount () returned 0x196d2 [0038.168] SetFilePointer (in: hFile=0x15c, lDistanceToMove=52252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcc1c [0038.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=39639, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ad7 [0038.168] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.169] GetTickCount () returned 0x196d2 [0038.170] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x55b9, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x55b9, lpOverlapped=0x0) returned 1 [0038.171] SetFilePointer (in: hFile=0x158, lDistanceToMove=28457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f29 [0038.171] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x397f, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x397f, lpOverlapped=0x0) returned 1 [0038.171] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x397f, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x397f, lpOverlapped=0x0) returned 1 [0038.172] SetFileTime (hFile=0x1c, lpCreationTime=0x18fd94, lpLastAccessTime=0x0, lpLastWriteTime=0x18fd94) returned 1 [0038.172] CloseHandle (hObject=0x1c) returned 1 [0038.174] lstrcpynA (in: lpString1=0x40b000, lpString2="Rhizome", iMaxLength=1024 | out: lpString1="Rhizome") returned="Rhizome" [0038.174] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.174] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.174] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.174] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="Rhizome" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Rhizome") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Rhizome" [0038.174] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Rhizome" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\rhizome")) returned 0xffffffff [0038.174] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Rhizome" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\rhizome")) returned 0xffffffff [0038.174] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Rhizome" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\rhizome"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0038.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=43176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa8a8 [0038.174] GetTickCount () returned 0x196d2 [0038.174] ReadFile (in: hFile=0x158, lpBuffer=0x18fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x18fbcc*, lpNumberOfBytesRead=0x18fbb4*=0x4, lpOverlapped=0x0) returned 1 [0038.175] GetTickCount () returned 0x196d2 [0038.175] SetFilePointer (in: hFile=0x15c, lDistanceToMove=68636, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c1c [0038.175] SetFilePointer (in: hFile=0x158, lDistanceToMove=61584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf090 [0038.175] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.175] GetTickCount () returned 0x196d2 [0038.176] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f19, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f19, lpOverlapped=0x0) returned 1 [0038.177] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.177] GetTickCount () returned 0x196d2 [0038.179] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f23, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f23, lpOverlapped=0x0) returned 1 [0038.179] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.179] GetTickCount () returned 0x196e1 [0038.181] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f1e, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f1e, lpOverlapped=0x0) returned 1 [0038.181] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.181] GetTickCount () returned 0x196e1 [0038.183] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f25, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f25, lpOverlapped=0x0) returned 1 [0038.183] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.183] GetTickCount () returned 0x196e1 [0038.185] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f1c, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f1c, lpOverlapped=0x0) returned 1 [0038.185] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.185] GetTickCount () returned 0x196e1 [0038.187] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f26, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f26, lpOverlapped=0x0) returned 1 [0038.187] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.188] GetTickCount () returned 0x196e1 [0038.189] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f26, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f26, lpOverlapped=0x0) returned 1 [0038.190] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.190] GetTickCount () returned 0x196e1 [0038.191] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f21, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f21, lpOverlapped=0x0) returned 1 [0038.192] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.192] GetTickCount () returned 0x196e1 [0038.196] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f2a, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f2a, lpOverlapped=0x0) returned 1 [0038.197] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.197] GetTickCount () returned 0x196f1 [0038.199] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x3f29, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x3f29, lpOverlapped=0x0) returned 1 [0038.199] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x4000, lpOverlapped=0x0) returned 1 [0038.199] GetTickCount () returned 0x196f1 [0038.201] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x6879, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x6879, lpOverlapped=0x0) returned 1 [0038.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=43180, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa8ac [0038.202] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.202] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.203] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.203] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.204] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.204] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.204] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.204] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.205] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.205] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.205] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.205] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.205] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.205] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.206] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.206] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.206] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.206] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.207] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.207] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.207] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.207] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.207] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x176e, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x176e, lpOverlapped=0x0) returned 1 [0038.207] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x176e, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x176e, lpOverlapped=0x0) returned 1 [0038.208] SetFileTime (hFile=0x1c, lpCreationTime=0x18fd94, lpLastAccessTime=0x0, lpLastWriteTime=0x18fd94) returned 1 [0038.208] CloseHandle (hObject=0x1c) returned 1 [0038.210] lstrcpynA (in: lpString1=0x40b000, lpString2="carls.dll", iMaxLength=1024 | out: lpString1="carls.dll") returned="carls.dll" [0038.210] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.211] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.211] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.211] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="carls.dll" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls.dll" [0038.211] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\carls.dll")) returned 0xffffffff [0038.211] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\carls.dll")) returned 0xffffffff [0038.211] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\carls.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0038.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=229402, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3801a [0038.211] GetTickCount () returned 0x19701 [0038.212] ReadFile (in: hFile=0x158, lpBuffer=0x18fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x18fbcc*, lpNumberOfBytesRead=0x18fbb4*=0x4, lpOverlapped=0x0) returned 1 [0038.212] GetTickCount () returned 0x19701 [0038.212] SetFilePointer (in: hFile=0x15c, lDistanceToMove=248860, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cc1c [0038.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=249956, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3d064 [0038.212] ReadFile (in: hFile=0x15c, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x2f1, lpNumberOfBytesRead=0x18fb90, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fb90*=0x2f1, lpOverlapped=0x0) returned 1 [0038.212] GetTickCount () returned 0x19701 [0038.212] WriteFile (in: hFile=0x158, lpBuffer=0x40b8d8*, nNumberOfBytesToWrite=0x5ba, lpNumberOfBytesWritten=0x18fb9c, lpOverlapped=0x0 | out: lpBuffer=0x40b8d8*, lpNumberOfBytesWritten=0x18fb9c*=0x5ba, lpOverlapped=0x0) returned 1 [0038.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=229406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3801e [0038.212] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.212] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x4000, lpOverlapped=0x0) returned 1 [0038.213] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x1600, lpOverlapped=0x0) returned 1 [0038.213] WriteFile (in: hFile=0x1c, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x1600, lpOverlapped=0x0) returned 1 [0038.213] SetFileTime (hFile=0x1c, lpCreationTime=0x18fd94, lpLastAccessTime=0x0, lpLastWriteTime=0x18fd94) returned 1 [0038.214] CloseHandle (hObject=0x1c) returned 1 [0038.214] lstrcpynA (in: lpString1=0x4236c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.214] lstrlenA (lpString="") returned 0 [0038.215] lstrcpynA (in: lpString1=0x40ac00, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.215] lstrcpynA (in: lpString1=0x40b000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.215] lstrcmpiA (lpString1="", lpString2="") returned 0 [0038.215] lstrcpynA (in: lpString1=0x4236c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.215] lstrlenA (lpString="") returned 0 [0038.215] lstrcpynA (in: lpString1=0x6125e4, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.215] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.215] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.215] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.215] GetTickCount () returned 0x19701 [0038.215] GetTempFileNameA (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpPrefixString="nsd", uUnique=0x0, lpTempFileName=0x425000 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp")) returned 0x9703 [0038.216] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.216] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.216] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.216] lstrcpynA (in: lpString1=0x422138, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.216] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", lpFindFileData=0x422580 | out: lpFindFileData=0x422580*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd055d100, ftCreationTime.dwHighDateTime=0x1d52863, ftLastAccessTime.dwLowDateTime=0xd055d100, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xd055d100, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8, cFileName="nsd9703.tmp", cAlternateFileName="")) returned 0x5d72f0 [0038.216] FindClose (in: hFindFile=0x5d72f0 | out: hFindFile=0x5d72f0) returned 1 [0038.216] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp")) returned 1 [0038.217] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.217] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.217] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.217] CreateDirectoryA (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0038.217] GetLastError () returned 0xb7 [0038.217] GetFileAttributesA (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0038.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1"), lpSecurityAttributes=0x0) returned 0 [0038.217] GetLastError () returned 0xb7 [0038.217] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1")) returned 0x10 [0038.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata"), lpSecurityAttributes=0x0) returned 0 [0038.217] GetLastError () returned 0xb7 [0038.217] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata")) returned 0x2012 [0038.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local"), lpSecurityAttributes=0x0) returned 0 [0038.217] GetLastError () returned 0xb7 [0038.217] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local")) returned 0x2010 [0038.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0038.217] GetLastError () returned 0xb7 [0038.217] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0038.218] GetModuleHandleA (lpModuleName="SHELL32") returned 0x75fd0000 [0038.218] GetProcAddress (hModule=0x75fd0000, lpProcName=0x2a8) returned 0x760244f5 [0038.218] IsUserAnAdmin () returned 1 [0038.218] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp"), lpSecurityAttributes=0x18f9d4) returned 1 [0038.218] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.219] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.219] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.219] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.219] lstrcpynA (in: lpString1=0x42b800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.219] lstrcpynA (in: lpString1=0x425000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.219] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.219] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.219] lstrcpynA (in: lpString1=0x40b000, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.219] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.219] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll")) returned 0xffffffff [0038.219] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0038.219] SetFilePointer (in: hFile=0x158, lDistanceToMove=11731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2dd3 [0038.219] GetTickCount () returned 0x19701 [0038.219] ReadFile (in: hFile=0x158, lpBuffer=0x18fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x18fbcc*, lpNumberOfBytesRead=0x18fbb4*=0x4, lpOverlapped=0x0) returned 1 [0038.219] GetTickCount () returned 0x19701 [0038.220] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18fbb4*=0x2e00, lpOverlapped=0x0) returned 1 [0038.220] WriteFile (in: hFile=0x184, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18fbb4*=0x2e00, lpOverlapped=0x0) returned 1 [0038.221] CloseHandle (hObject=0x184) returned 1 [0038.223] lstrcpynA (in: lpString1=0x6125e4, lpString2="8", iMaxLength=1024 | out: lpString1="8") returned="8" [0038.223] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.223] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.223] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.223] lstrcpynA (in: lpString1=0x40a400, lpString2="Alloc", iMaxLength=1024 | out: lpString1="Alloc") returned="Alloc" [0038.224] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned 0x0 [0038.226] LoadLibraryExA (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", hFile=0x0, dwFlags=0x8) returned 0x74720000 [0038.247] VirtualProtect (in: lpAddress=0x7472404c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x7472403c | out: lpflOldProtect=0x7472403c*=0x4) returned 1 [0038.248] GetProcAddress (hModule=0x74720000, lpProcName="Alloc") returned 0x74721000 [0038.248] wsprintfA (in: param_1=0x18fb7c, param_2="%d" | out: param_1="6168848") returned 7 [0038.248] lstrcpynA (in: lpString1=0x6125e4, lpString2="6168848", iMaxLength=1024 | out: lpString1="6168848") returned="6168848" [0038.248] FreeLibrary (hLibModule=0x74720000) returned 1 [0038.249] lstrcpynA (in: lpString1=0x425800, lpString2="6168848", iMaxLength=1024 | out: lpString1="6168848") returned="6168848" [0038.249] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.249] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.249] lstrcpynA (in: lpString1=0x40ac00, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.249] lstrcpynA (in: lpString1=0x40b000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.249] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", lpString2="") returned 1 [0038.249] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.249] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.249] lstrcpynA (in: lpString1=0x40b000, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.249] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.249] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll")) returned 0x2020 [0038.250] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0038.250] lstrcpynA (in: lpString1=0x4236c1, lpString2="6168848", iMaxLength=1024 | out: lpString1="6168848") returned="6168848" [0038.250] lstrlenA (lpString="6168848") returned 7 [0038.250] lstrcpynA (in: lpString1=0x6125e4, lpString2="*6168848(i 14906)", iMaxLength=1024 | out: lpString1="*6168848(i 14906)") returned="*6168848(i 14906)" [0038.250] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.250] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.250] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.250] lstrcpynA (in: lpString1=0x40a400, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0038.250] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned 0x0 [0038.252] LoadLibraryExA (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", hFile=0x0, dwFlags=0x8) returned 0x74710000 [0038.253] VirtualProtect (in: lpAddress=0x7471404c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x7471403c | out: lpflOldProtect=0x7471403c*=0x4) returned 1 [0038.253] GetProcAddress (hModule=0x74710000, lpProcName="Call") returned 0x747116db [0038.254] lstrcpyA (in: lpString1=0x615200, lpString2="6168848" | out: lpString1="6168848") returned="6168848" [0038.254] lstrcpynA (in: lpString1=0x6125e0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.254] wsprintfA (in: param_1=0x6125e0, param_2="%d" | out: param_1="14906") returned 5 [0038.254] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.254] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.254] lstrcpynA (in: lpString1=0x40ac00, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.254] lstrcpynA (in: lpString1=0x40b000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.254] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", lpString2="") returned 1 [0038.254] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.254] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.254] lstrcpynA (in: lpString1=0x40b000, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.254] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.255] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll")) returned 0x2020 [0038.255] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0038.255] lstrcpynA (in: lpString1=0x4236c1, lpString2="6168848", iMaxLength=1024 | out: lpString1="6168848") returned="6168848" [0038.255] lstrlenA (lpString="6168848") returned 7 [0038.255] lstrcpynA (in: lpString1=0x6125e4, lpString2="*6168848(&t4 .r1)", iMaxLength=1024 | out: lpString1="*6168848(&t4 .r1)") returned="*6168848(&t4 .r1)" [0038.255] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.255] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.255] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.255] lstrcpynA (in: lpString1=0x40a400, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0038.255] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned 0x74710000 [0038.255] GetProcAddress (hModule=0x74710000, lpProcName="Call") returned 0x747116db [0038.255] lstrcpyA (in: lpString1=0x615200, lpString2="6168848" | out: lpString1="6168848") returned="6168848" [0038.255] lstrcpynA (in: lpString1=0x6125e0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.255] lstrcpynA (in: lpString1=0x6145e8, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.256] lstrcpynA (in: lpString1=0x6149f0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.256] lstrcpynA (in: lpString1=0x6149f0, lpString2="::", iMaxLength=1024 | out: lpString1="::") returned="::" [0038.256] lstrcpyA (in: lpString1=0x425400, lpString2="::" | out: lpString1="::") returned="::" [0038.256] lstrcpynA (in: lpString1=0x40ac00, lpString2="Software\\giFT\\giFT", iMaxLength=1024 | out: lpString1="Software\\giFT\\giFT") returned="Software\\giFT\\giFT" [0038.256] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\giFT\\giFT", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f9e8 | out: phkResult=0x18f9e8*=0x0) returned 0x2 [0038.256] lstrcpynA (in: lpString1=0x40b000, lpString2="instpath", iMaxLength=1024 | out: lpString1="instpath") returned="instpath" [0038.257] lstrcpynA (in: lpString1=0x4236c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.257] lstrlenA (lpString="") returned 0 [0038.257] wsprintfA (in: param_1=0x427800, param_2="%d" | out: param_1="0") returned 1 [0038.257] lstrcpynA (in: lpString1=0x4236c0, lpString2="0", iMaxLength=1024 | out: lpString1="0") returned="0" [0038.257] lstrlenA (lpString="0") returned 1 [0038.257] wsprintfA (in: param_1=0x427800, param_2="%d" | out: param_1="1") returned 1 [0038.257] lstrcpynA (in: lpString1=0x4236c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.257] lstrlenA (lpString="") returned 0 [0038.257] lstrcpynA (in: lpString1=0x4236c0, lpString2="1", iMaxLength=1024 | out: lpString1="1") returned="1" [0038.257] lstrlenA (lpString="1") returned 1 [0038.257] lstrcpynA (in: lpString1=0x4236c0, lpString2="1", iMaxLength=1024 | out: lpString1="1") returned="1" [0038.257] lstrlenA (lpString="1") returned 1 [0038.257] wsprintfA (in: param_1=0x427800, param_2="%d" | out: param_1="1") returned 1 [0038.257] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.257] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.257] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls" [0038.257] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned 42 [0038.257] lstrcpynA (in: lpString1=0x425800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls" [0038.257] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls" [0038.257] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned 42 [0038.257] lstrcpynA (in: lpString1=0x4236ea, lpString2="::", iMaxLength=1024 | out: lpString1="::") returned="::" [0038.257] lstrlenA (lpString="::") returned 2 [0038.257] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q" [0038.257] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q") returned 45 [0038.257] lstrcpynA (in: lpString1=0x425800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q" [0038.257] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.258] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.258] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.258] CreateDirectoryA (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0038.258] GetLastError () returned 0xb7 [0038.258] GetFileAttributesA (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0038.258] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1"), lpSecurityAttributes=0x0) returned 0 [0038.258] GetLastError () returned 0xb7 [0038.258] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1")) returned 0x10 [0038.258] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata"), lpSecurityAttributes=0x0) returned 0 [0038.258] GetLastError () returned 0xb7 [0038.258] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata")) returned 0x2012 [0038.258] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local"), lpSecurityAttributes=0x0) returned 0 [0038.258] GetLastError () returned 0xb7 [0038.258] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local")) returned 0x2010 [0038.259] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0038.259] GetLastError () returned 0xb7 [0038.259] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0038.259] lstrcpynA (in: lpString1=0x42a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0038.259] SetCurrentDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 1 [0038.259] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.259] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.259] lstrcpynA (in: lpString1=0x40ac00, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.259] lstrcpynA (in: lpString1=0x40b000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.259] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", lpString2="") returned 1 [0038.259] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.259] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.259] lstrcpynA (in: lpString1=0x40b000, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll" [0038.259] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll" [0038.259] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\splash.dll")) returned 0xffffffff [0038.259] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\splash.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0038.261] SetFilePointer (in: hFile=0x158, lDistanceToMove=7631, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1dcf [0038.261] GetTickCount () returned 0x1972f [0038.261] ReadFile (in: hFile=0x158, lpBuffer=0x18f9dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18f9c4, lpOverlapped=0x0 | out: lpBuffer=0x18f9dc*, lpNumberOfBytesRead=0x18f9c4*=0x4, lpOverlapped=0x0) returned 1 [0038.261] GetTickCount () returned 0x1972f [0038.261] ReadFile (in: hFile=0x158, lpBuffer=0x4138d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18f9c4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesRead=0x18f9c4*=0x1000, lpOverlapped=0x0) returned 1 [0038.261] WriteFile (in: hFile=0x184, lpBuffer=0x4138d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18f9c4, lpOverlapped=0x0 | out: lpBuffer=0x4138d8*, lpNumberOfBytesWritten=0x18f9c4*=0x1000, lpOverlapped=0x0) returned 1 [0038.262] CloseHandle (hObject=0x184) returned 1 [0038.264] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.264] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.264] lstrcpynA (in: lpString1=0x614604, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp" [0038.264] lstrcpynA (in: lpString1=0x614a4c, lpString2="2500", iMaxLength=1024 | out: lpString1="2500") returned="2500" [0038.264] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.264] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.264] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll" [0038.264] lstrcpynA (in: lpString1=0x40a400, lpString2="show", iMaxLength=1024 | out: lpString1="show") returned="show" [0038.264] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll") returned 0x0 [0038.265] LoadLibraryExA (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\Splash.dll", hFile=0x0, dwFlags=0x8) returned 0x74720000 [0038.494] GetProcAddress (hModule=0x74720000, lpProcName="show") returned 0x7472100f [0038.494] lstrcpyA (in: lpString1=0x18f990, lpString2="2500" | out: lpString1="2500") returned="2500" [0038.494] lstrcpyA (in: lpString1=0x18f870, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp" [0038.494] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0038.494] RegisterClassA (lpWndClass=0x7472301c) returned 0x28c13c [0038.494] lstrcpyA (in: lpString1=0x18f76c, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp" [0038.494] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp", lpString2=".bmp" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp" [0038.494] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp", lpString2=".wav" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.wav") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.wav" [0038.494] LoadImageA (hInst=0x0, name="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp", type=0x0, cx=0, cy=0, fuLoad=0x2010) returned 0x0 [0038.496] wsprintfA (in: param_1=0x18f990, param_2="%d" | out: param_1="-1") returned 2 [0038.496] lstrcpynA (in: lpString1=0x614604, lpString2="-1", iMaxLength=1024 | out: lpString1="-1") returned="-1" [0038.496] FreeLibrary (hLibModule=0x74720000) returned 1 [0038.498] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.498] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.498] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp" [0038.498] lstrcpynA (in: lpString1=0x422138, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp" [0038.498] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp") returned 47 [0038.498] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp", lpFindFileData=0x422580 | out: lpFindFileData=0x422580*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd055d100, ftCreationTime.dwHighDateTime=0x1d52863, ftLastAccessTime.dwLowDateTime=0xd055d100, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xd055d100, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8, cFileName="nsd9703.tmp", cAlternateFileName="")) returned 0xffffffff [0038.498] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp") returned 47 [0038.499] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.499] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFindFileData=0x422580 | out: lpFindFileData=0x422580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd055d100, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xd055d100, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7716387a, dwReserved1=0x773a450a, cFileName="Temp", cAlternateFileName="")) returned 0x5e4ee8 [0038.499] FindClose (in: hFindFile=0x5e4ee8 | out: hFindFile=0x5e4ee8) returned 1 [0038.499] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0038.499] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local") returned 31 [0038.499] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local", lpFindFileData=0x422580 | out: lpFindFileData=0x422580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7716387a, dwReserved1=0x773a450a, cFileName="Local", cAlternateFileName="")) returned 0x5e4ee8 [0038.499] FindClose (in: hFindFile=0x5e4ee8 | out: hFindFile=0x5e4ee8) returned 1 [0038.499] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local") returned 31 [0038.500] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData") returned 25 [0038.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData", lpFindFileData=0x422580 | out: lpFindFileData=0x422580*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7716387a, dwReserved1=0x773a450a, cFileName="AppData", cAlternateFileName="")) returned 0x5d72f0 [0038.500] FindClose (in: hFindFile=0x5d72f0 | out: hFindFile=0x5d72f0) returned 1 [0038.500] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData") returned 25 [0038.500] lstrlenA (lpString="C:\\Users\\5P5NRG~1") returned 17 [0038.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1", lpFindFileData=0x422580 | out: lpFindFileData=0x422580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7716387a, dwReserved1=0x773a450a, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5d72f0 [0038.500] FindClose (in: hFindFile=0x5d72f0 | out: hFindFile=0x5d72f0) returned 1 [0038.500] lstrlenA (lpString="C:\\Users\\5P5NRG~1") returned 17 [0038.500] lstrlenA (lpString="C:\\Users") returned 8 [0038.500] FindFirstFileA (in: lpFileName="C:\\Users", lpFindFileData=0x422580 | out: lpFindFileData=0x422580*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7716387a, dwReserved1=0x773a450a, cFileName="Users", cAlternateFileName="")) returned 0x5d72f0 [0038.501] FindClose (in: hFindFile=0x5d72f0 | out: hFindFile=0x5d72f0) returned 1 [0038.501] lstrlenA (lpString="C:\\Users") returned 8 [0038.501] lstrlenA (lpString="C:") returned 2 [0038.501] lstrlenA (lpString="C:") returned 2 [0038.501] lstrcatA (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0038.501] GetFileAttributesA (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0038.501] lstrcpynA (in: lpString1=0x421d38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp" [0038.501] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp") returned 47 [0038.501] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0038.501] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 37 [0038.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\spltmp.bmp", lpFindFileData=0x18f890 | out: lpFindFileData=0x18f890*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x5c0000, ftLastAccessTime.dwLowDateTime=0x5d53d8, ftLastAccessTime.dwHighDateTime=0x18f8f8, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x5c0000, nFileSizeHigh=0x5d0838, nFileSizeLow=0x0, dwReserved0=0x77232160, dwReserved1=0x252001b, cFileName="#", cAlternateFileName="\x80\xff\xff\xff\xcd\x1e\x1a\x77\xae\x0e\x37")) returned 0xffffffff [0038.502] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.502] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.502] lstrcpynA (in: lpString1=0x40ac00, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.502] lstrcpynA (in: lpString1=0x40b000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.502] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", lpString2="") returned 1 [0038.502] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.502] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.502] lstrcpynA (in: lpString1=0x40b000, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.502] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.502] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll")) returned 0x2020 [0038.502] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0038.502] lstrcpynA (in: lpString1=0x614a4c, lpString2="kernel32::CreateMutexA(i 0, i 0, t \"OpenMetaverseInstaller\") i .r1 ?e", iMaxLength=1024 | out: lpString1="kernel32::CreateMutexA(i 0, i 0, t \"OpenMetaverseInstaller\") i .r1 ?e") returned="kernel32::CreateMutexA(i 0, i 0, t \"OpenMetaverseInstaller\") i .r1 ?e" [0038.502] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.502] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.502] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.502] lstrcpynA (in: lpString1=0x40a400, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0038.503] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned 0x74710000 [0038.503] GetProcAddress (hModule=0x74710000, lpProcName="Call") returned 0x747116db [0038.503] lstrcpyA (in: lpString1=0x61d218, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0038.503] lstrcpyA (in: lpString1=0x61d628, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0038.503] lstrcpyA (in: lpString1=0x61da28, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0038.503] lstrcpynA (in: lpString1=0x61f2e0, lpString2="OpenMetaverseInstaller", iMaxLength=1024 | out: lpString1="OpenMetaverseInstaller") returned="OpenMetaverseInstaller" [0038.503] GetModuleHandleA (lpModuleName="kernel32") returned 0x76c20000 [0038.503] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0038.503] lstrlenA (lpString="CreateMutexA") returned 12 [0038.503] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexAA") returned 0x0 [0038.503] lstrcpynA (in: lpString1=0x61d218, lpString2="OpenMetaverseInstaller", iMaxLength=1024 | out: lpString1="OpenMetaverseInstaller") returned="OpenMetaverseInstaller" [0038.504] lstrcpynA (in: lpString1=0x61c5e8, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.504] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="OpenMetaverseInstaller") returned 0x184 [0038.504] GetLastError () returned 0x0 [0038.504] lstrcpynA (in: lpString1=0x61c5e8, lpString2="OpenMetaverseInstaller", iMaxLength=1024 | out: lpString1="OpenMetaverseInstaller") returned="OpenMetaverseInstaller" [0038.504] wsprintfA (in: param_1=0x61c5e8, param_2="%d" | out: param_1="0") returned 1 [0038.504] wsprintfA (in: param_1=0x61c5e8, param_2="%d" | out: param_1="0") returned 1 [0038.504] wsprintfA (in: param_1=0x61c5e8, param_2="%d" | out: param_1="388") returned 3 [0038.504] lstrcpyA (in: lpString1=0x425400, lpString2="388" | out: lpString1="388") returned="388" [0038.504] wsprintfA (in: param_1=0x18f938, param_2="%d" | out: param_1="0") returned 1 [0038.504] lstrcpynA (in: lpString1=0x614a4c, lpString2="0", iMaxLength=1024 | out: lpString1="0") returned="0" [0038.504] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.504] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.504] lstrcpynA (in: lpString1=0x40ac00, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.504] lstrcpynA (in: lpString1=0x40b000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.504] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", lpString2="") returned 1 [0038.504] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.504] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.504] lstrcpynA (in: lpString1=0x40b000, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.504] lstrcpynA (in: lpString1=0x40a400, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.505] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll")) returned 0x2020 [0038.505] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsd9703.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0038.505] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q" [0038.505] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q") returned 45 [0038.505] lstrcpynA (in: lpString1=0x614e94, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls::q" [0038.505] lstrcpynA (in: lpString1=0x4236c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp" [0038.505] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp") returned 48 [0038.505] lstrcpynA (in: lpString1=0x40a800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll" [0038.505] lstrcpynA (in: lpString1=0x40a400, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0038.505] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsd9703.tmp\\System.dll") returned 0x74710000 [0038.505] GetProcAddress (hModule=0x74710000, lpProcName="Call") returned 0x747116db [0038.505] lstrcpyA (in: lpString1=0x61d218, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls" [0038.505] lstrcpyA (in: lpString1=0x61d628, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls" [0038.505] lstrcpyA (in: lpString1=0x61da28, lpString2="q" | out: lpString1="q") returned="q" [0038.506] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned 0x0 [0038.507] LoadLibraryA (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\carls") returned 0x74720000 [0038.516] GetVersion () returned 0x1db10106 [0038.516] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x3180000 [0038.517] RtlAllocateHeap (HeapHandle=0x3180000, Flags=0x0, Size=0x140) returned 0x31807d0 [0038.517] RtlAllocateHeap (HeapHandle=0x3180000, Flags=0x8, Size=0x41c4) returned 0x3180918 [0038.517] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x2f90000 [0038.518] VirtualAlloc (lpAddress=0x2f90000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2f90000 [0038.518] GetCurrentThreadId () returned 0x97c [0038.518] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe\" " [0038.518] GetEnvironmentStringsW () returned 0x61ead0* [0038.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0038.518] RtlAllocateHeap (HeapHandle=0x3180000, Flags=0x0, Size=0x570) returned 0x3184ae8 [0038.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x3184ae8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0038.519] FreeEnvironmentStringsW (penv=0x61ead0) returned 1 [0038.519] RtlAllocateHeap (HeapHandle=0x3180000, Flags=0x0, Size=0x480) returned 0x3185060 [0038.519] GetStartupInfoA (in: lpStartupInfo=0x18f584 | out: lpStartupInfo=0x18f584*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0038.519] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0038.519] GetFileType (hFile=0x0) returned 0x0 [0038.519] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.519] GetFileType (hFile=0x0) returned 0x0 [0038.519] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0038.519] GetFileType (hFile=0x0) returned 0x0 [0038.519] SetHandleCount (uNumber=0x20) returned 0x20 [0038.519] GetACP () returned 0x4e4 [0038.519] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f590 | out: lpCPInfo=0x18f590) returned 1 [0038.519] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f568 | out: lpCPInfo=0x18f568) returned 1 [0038.519] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f024 | out: lpCharType=0x18f024) returned 1 [0038.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f468, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0038.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f468, cbMultiByte=256, lpWideCharStr=0x18ee0c, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ弌瑲Ā") returned 256 [0038.519] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ弌瑲Ā", cchSrc=256, lpCharType=0x18f068 | out: lpCharType=0x18f068) returned 1 [0038.519] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0038.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f468, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0038.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f468, cbMultiByte=256, lpWideCharStr=0x18ede8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ弌瑲Ā") returned 256 [0038.519] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ弌瑲Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0038.519] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ弌瑲Ā", cchSrc=256, lpDestStr=0x18ebe8, cchDest=256 | out: lpDestStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x161\x2039\x153\x8d\x17e\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x5f0c\x7472\x100") returned 256 [0038.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x220, lpWideCharStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x161\x2039\x153\x8d\x17e\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x5f0c\x7472\x100", cchWideChar=256, lpMultiByteStr=0x18f368, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x01", lpUsedDefaultChar=0x0) returned 256 [0038.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f468, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0038.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f468, cbMultiByte=256, lpWideCharStr=0x18edc8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ弌瑲Ā") returned 256 [0038.520] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ弌瑲Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0038.520] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ弌瑲Ā", cchSrc=256, lpDestStr=0x18ebc8, cchDest=256 | out: lpDestStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x191\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x160\x203a\x152\x9d\x17d\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x178\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x5f0c\x7472\x100") returned 256 [0038.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x220, lpWideCharStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x191\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x160\x203a\x152\x9d\x17d\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x178\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x5f0c\x7472\x100", cchWideChar=256, lpMultiByteStr=0x18f268, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x01", lpUsedDefaultChar=0x0) returned 256 [0038.520] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x74725a14, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\greencrypt_crypt.exe")) returned 0x3a [0038.522] HeapFree (in: hHeap=0x3180000, dwFlags=0x0, lpMem=0x3184ae8 | out: hHeap=0x3180000) returned 1 [0038.522] GetProcAddress (hModule=0x74720000, lpProcName="q") returned 0x74721090 [0038.522] lstrcpynA (in: lpString1=0x61d218, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0038.522] GetModuleHandleA (lpModuleName="kernel32") returned 0x76c20000 [0038.522] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0038.522] VirtualAlloc (lpAddress=0x0, dwSize=0x5a1, flAllocationType=0x3000, flProtect=0x40) returned 0x3c0000 [0038.523] GetModuleHandleA (lpModuleName="kernel32") returned 0x76c20000 [0038.523] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0038.523] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0038.524] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0038.524] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0038.524] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0038.524] CreateFileA (lpFileName="Rhizome" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\rhizome"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x50, hTemplateFile=0x0) returned 0x18c [0038.524] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d76e [0038.526] ReadFile (in: hFile=0x18c, lpBuffer=0x61ead0, nNumberOfBytesToRead=0x2d76e, lpNumberOfBytesRead=0x18f870, lpOverlapped=0x0 | out: lpBuffer=0x61ead0*, lpNumberOfBytesRead=0x18f870*=0x2d76e, lpOverlapped=0x0) returned 1 [0038.526] CloseHandle (hObject=0x18c) returned 1 [0038.527] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0038.527] VirtualAlloc (lpAddress=0x0, dwSize=0x918, flAllocationType=0x3000, flProtect=0x40) returned 0x3090000 [0038.528] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0038.528] LoadLibraryA (lpLibFileName="user32") returned 0x74f40000 [0038.528] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0038.528] VirtualAlloc (lpAddress=0x0, dwSize=0x7000, flAllocationType=0x3000, flProtect=0x40) returned 0x30a0000 [0038.528] RtlCreateUnicodeStringFromAsciiz (in: Destination=0x18f6cc, Source="USER32.dll" | out: Destination="USER32.dll") returned 1 [0038.529] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="USER32.dll", BaseAddress=0x18f6e4 | out: BaseAddress=0x18f6e4*=0x74f40000) returned 0x0 [0038.529] LdrGetProcedureAddress (in: BaseAddress=0x74f40000, Name="GetSysColor", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x74f56c3c) returned 0x0 [0038.529] LdrGetProcedureAddress (in: BaseAddress=0x74f40000, Name="MessageBoxExA", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x74fafcd6) returned 0x0 [0038.529] LdrGetProcedureAddress (in: BaseAddress=0x74f40000, Name="ScrollWindow", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x74f69320) returned 0x0 [0038.529] RtlCreateUnicodeStringFromAsciiz (in: Destination=0x18f6cc, Source="ADVAPI32.dll" | out: Destination="ADVAPI32.dll") returned 1 [0038.529] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="ADVAPI32.dll", BaseAddress=0x18f6e4 | out: BaseAddress=0x18f6e4*=0x74d40000) returned 0x0 [0038.529] LdrGetProcedureAddress (in: BaseAddress=0x74d40000, Name="CryptDecrypt", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x74d83178) returned 0x0 [0038.529] RtlCreateUnicodeStringFromAsciiz (in: Destination=0x18f6cc, Source="KERNEL32.dll" | out: Destination="KERNEL32.dll") returned 1 [0038.529] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="KERNEL32.dll", BaseAddress=0x18f6e4 | out: BaseAddress=0x18f6e4*=0x76c20000) returned 0x0 [0038.529] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="SwitchToThread", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x76c4efec) returned 0x0 [0038.530] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="GetCurrentProcessId", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x76c311f8) returned 0x0 [0038.530] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="SystemTimeToTzSpecificLocalTime", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x76c50652) returned 0x0 [0038.530] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="WriteProfileStringA", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x76caa79a) returned 0x0 [0038.530] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="SetThreadPriorityBoost", Ordinal=0x0, ProcedureAddress=0x18f6dc | out: ProcedureAddress=0x18f6dc*=0x76cb456f) returned 0x0 [0038.530] VirtualProtect (in: lpAddress=0x30a0000, dwSize=0x7000, flNewProtect=0x4, lpflOldProtect=0x18f768 | out: lpflOldProtect=0x18f768*=0x40) returned 1 [0038.530] VirtualProtect (in: lpAddress=0x30a1000, dwSize=0x1d50, flNewProtect=0x20, lpflOldProtect=0x18f768 | out: lpflOldProtect=0x18f768*=0x4) returned 1 [0038.535] VirtualProtect (in: lpAddress=0x30a3000, dwSize=0x228, flNewProtect=0x2, lpflOldProtect=0x18f768 | out: lpflOldProtect=0x18f768*=0x4) returned 1 [0038.535] VirtualProtect (in: lpAddress=0x30a4000, dwSize=0x63d, flNewProtect=0x4, lpflOldProtect=0x18f768 | out: lpflOldProtect=0x18f768*=0x4) returned 1 [0038.535] VirtualProtect (in: lpAddress=0x30a5000, dwSize=0x368, flNewProtect=0x2, lpflOldProtect=0x18f768 | out: lpflOldProtect=0x18f768*=0x4) returned 1 [0038.535] VirtualProtect (in: lpAddress=0x30a6000, dwSize=0x440, flNewProtect=0x2, lpflOldProtect=0x18f768 | out: lpflOldProtect=0x18f768*=0x4) returned 1 [0038.536] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.636] SwitchToThread () returned 1 [0038.639] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.639] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.642] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.642] SwitchToThread () returned 1 [0038.647] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.647] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.648] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.648] SwitchToThread () returned 1 [0038.657] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.657] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.658] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.658] SwitchToThread () returned 1 [0038.660] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.660] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.661] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.661] SwitchToThread () returned 1 [0038.662] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.662] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.663] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.663] SwitchToThread () returned 1 [0038.663] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.663] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.664] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.664] SwitchToThread () returned 1 [0038.678] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.678] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.679] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.679] SwitchToThread () returned 1 [0038.693] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.693] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.694] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.694] SwitchToThread () returned 1 [0038.708] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.709] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.710] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.710] SwitchToThread () returned 0 [0038.710] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.710] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.711] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.711] SwitchToThread () returned 0 [0038.711] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.711] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.712] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.712] SwitchToThread () returned 0 [0038.712] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.712] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.713] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.713] SwitchToThread () returned 0 [0038.713] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.713] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.714] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.714] SwitchToThread () returned 0 [0038.714] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.714] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.715] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.715] SwitchToThread () returned 0 [0038.715] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.715] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.716] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.716] SwitchToThread () returned 0 [0038.716] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.716] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.717] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.717] SwitchToThread () returned 0 [0038.717] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.717] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.718] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.718] SwitchToThread () returned 0 [0038.718] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.718] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.719] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.719] SwitchToThread () returned 0 [0038.719] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.719] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.720] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.720] SwitchToThread () returned 0 [0038.720] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.720] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.721] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.721] SwitchToThread () returned 0 [0038.721] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.721] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.722] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.722] SwitchToThread () returned 0 [0038.722] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.722] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.723] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.723] SwitchToThread () returned 0 [0038.723] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.723] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.724] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.724] SwitchToThread () returned 1 [0038.725] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.725] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.725] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.726] SwitchToThread () returned 0 [0038.726] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.726] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.726] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.726] SwitchToThread () returned 1 [0038.727] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.727] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.728] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.728] SwitchToThread () returned 0 [0038.728] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.728] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.729] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.729] SwitchToThread () returned 0 [0038.729] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.729] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.730] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.730] SwitchToThread () returned 0 [0038.730] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.730] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.731] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.731] SwitchToThread () returned 0 [0038.731] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.731] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.732] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.732] SwitchToThread () returned 0 [0038.732] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.732] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.735] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.735] SwitchToThread () returned 0 [0038.735] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.735] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.736] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.736] SwitchToThread () returned 0 [0038.736] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.736] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.737] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.737] SwitchToThread () returned 0 [0038.737] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.737] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.738] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.738] SwitchToThread () returned 0 [0038.738] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.738] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.739] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.739] SwitchToThread () returned 0 [0038.739] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.739] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.740] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.740] SwitchToThread () returned 0 [0038.740] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.740] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.741] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.741] SwitchToThread () returned 0 [0038.741] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.741] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.742] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.742] SwitchToThread () returned 0 [0038.742] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.742] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.743] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.743] SwitchToThread () returned 0 [0038.743] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.743] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.744] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.744] SwitchToThread () returned 0 [0038.744] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.744] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.745] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.745] SwitchToThread () returned 0 [0038.745] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.745] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.746] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.746] SwitchToThread () returned 0 [0038.746] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.746] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.746] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.747] SwitchToThread () returned 0 [0038.747] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.747] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.747] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.747] SwitchToThread () returned 0 [0038.747] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.747] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.748] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.748] SwitchToThread () returned 0 [0038.749] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.749] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.749] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.749] SwitchToThread () returned 0 [0038.750] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.750] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.750] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.750] SwitchToThread () returned 0 [0038.750] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.750] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.751] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.751] SwitchToThread () returned 0 [0038.751] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.751] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.752] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.752] SwitchToThread () returned 0 [0038.752] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.752] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.753] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.753] SwitchToThread () returned 1 [0038.753] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.753] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.754] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.754] SwitchToThread () returned 0 [0038.754] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.754] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.755] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.755] SwitchToThread () returned 0 [0038.755] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.755] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.757] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.757] SwitchToThread () returned 0 [0038.757] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.757] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.757] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.757] SwitchToThread () returned 0 [0038.757] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.758] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.758] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.758] SwitchToThread () returned 0 [0038.758] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.758] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.759] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.759] SwitchToThread () returned 0 [0038.759] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.760] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.760] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.760] SwitchToThread () returned 0 [0038.760] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.760] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.761] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.761] SwitchToThread () returned 0 [0038.761] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.761] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.762] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.762] SwitchToThread () returned 0 [0038.762] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.762] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.763] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.763] SwitchToThread () returned 0 [0038.763] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.764] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.764] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.764] SwitchToThread () returned 0 [0038.765] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.765] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.766] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.766] SwitchToThread () returned 0 [0038.766] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.766] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.767] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.767] SwitchToThread () returned 0 [0038.767] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.767] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.768] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.768] SwitchToThread () returned 0 [0038.768] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.768] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.769] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.769] SwitchToThread () returned 0 [0038.769] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.769] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.770] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.770] SwitchToThread () returned 0 [0038.770] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.770] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.771] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.771] SwitchToThread () returned 0 [0038.771] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.771] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.772] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.772] SwitchToThread () returned 0 [0038.772] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.772] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.773] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.773] SwitchToThread () returned 0 [0038.773] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.773] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.774] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.774] SwitchToThread () returned 0 [0038.774] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.774] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.775] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.775] SwitchToThread () returned 0 [0038.775] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.775] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.776] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.776] SwitchToThread () returned 0 [0038.776] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.776] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.777] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.777] SwitchToThread () returned 0 [0038.777] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.777] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.778] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.778] SwitchToThread () returned 0 [0038.778] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.778] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.779] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.779] SwitchToThread () returned 1 [0038.779] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.779] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.780] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.780] SwitchToThread () returned 0 [0038.780] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.780] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.781] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.781] SwitchToThread () returned 0 [0038.781] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.781] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.781] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.782] SwitchToThread () returned 0 [0038.782] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.782] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.782] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.782] SwitchToThread () returned 0 [0038.782] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.783] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.783] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.783] SwitchToThread () returned 0 [0038.783] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.783] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.784] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.784] SwitchToThread () returned 0 [0038.784] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.784] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.785] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.785] SwitchToThread () returned 0 [0038.785] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.785] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.787] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.787] SwitchToThread () returned 0 [0038.787] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.787] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.788] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.788] SwitchToThread () returned 0 [0038.788] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.788] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.788] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.789] SwitchToThread () returned 0 [0038.789] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.789] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.789] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.789] SwitchToThread () returned 0 [0038.789] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.789] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.790] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.790] SwitchToThread () returned 0 [0038.790] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.790] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.792] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.792] SwitchToThread () returned 0 [0038.792] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.792] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.793] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.793] SwitchToThread () returned 0 [0038.793] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.793] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.794] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.794] SwitchToThread () returned 0 [0038.794] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.794] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.795] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.795] SwitchToThread () returned 0 [0038.795] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.795] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.796] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.796] SwitchToThread () returned 0 [0038.796] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.796] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.796] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.797] SwitchToThread () returned 0 [0038.797] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.797] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.797] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.797] SwitchToThread () returned 0 [0038.797] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.798] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.798] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.798] SwitchToThread () returned 0 [0038.798] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.798] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.799] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.799] SwitchToThread () returned 0 [0038.799] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.800] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.800] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.800] SwitchToThread () returned 0 [0038.800] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.800] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.801] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.801] SwitchToThread () returned 0 [0038.801] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.801] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.802] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.802] SwitchToThread () returned 0 [0038.802] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.802] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.803] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.803] SwitchToThread () returned 1 [0038.804] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.804] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.804] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.804] SwitchToThread () returned 0 [0038.804] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.804] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.805] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.805] SwitchToThread () returned 0 [0038.805] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.805] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.806] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.806] SwitchToThread () returned 0 [0038.806] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.806] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.807] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.807] SwitchToThread () returned 0 [0038.807] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.807] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.808] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.808] SwitchToThread () returned 0 [0038.808] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.808] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.809] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.809] SwitchToThread () returned 0 [0038.809] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.809] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.810] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.810] SwitchToThread () returned 0 [0038.810] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.810] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.811] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.811] SwitchToThread () returned 0 [0038.811] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.811] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.812] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.812] SwitchToThread () returned 0 [0038.812] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.812] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.813] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.813] SwitchToThread () returned 0 [0038.813] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.813] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.813] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.814] SwitchToThread () returned 0 [0038.814] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.814] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.814] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.814] SwitchToThread () returned 0 [0038.814] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.815] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.815] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.815] SwitchToThread () returned 0 [0038.815] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.816] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.816] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.816] SwitchToThread () returned 0 [0038.816] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.816] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.817] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.817] SwitchToThread () returned 0 [0038.817] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.817] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.818] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.818] SwitchToThread () returned 0 [0038.818] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.818] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.819] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.819] SwitchToThread () returned 0 [0038.819] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.819] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.820] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.820] SwitchToThread () returned 0 [0038.820] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.820] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.821] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.821] SwitchToThread () returned 0 [0038.821] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.821] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.822] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.822] SwitchToThread () returned 0 [0038.822] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.822] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.823] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.823] SwitchToThread () returned 0 [0038.823] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.823] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.824] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.824] SwitchToThread () returned 0 [0038.824] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.824] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.825] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.825] SwitchToThread () returned 0 [0038.825] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.825] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.826] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.826] SwitchToThread () returned 0 [0038.826] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.826] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.827] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.827] SwitchToThread () returned 1 [0038.827] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.827] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.828] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.828] SwitchToThread () returned 0 [0038.828] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.828] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.829] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.829] SwitchToThread () returned 0 [0038.829] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.829] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.830] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.830] SwitchToThread () returned 0 [0038.830] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.830] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.831] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.831] SwitchToThread () returned 0 [0038.831] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.831] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.832] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.832] SwitchToThread () returned 0 [0038.832] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.832] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.833] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.833] SwitchToThread () returned 0 [0038.833] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.833] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.834] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.834] SwitchToThread () returned 0 [0038.834] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.834] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.835] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.835] SwitchToThread () returned 0 [0038.835] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.835] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.836] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.836] SwitchToThread () returned 0 [0038.836] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.836] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.837] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.837] SwitchToThread () returned 0 [0038.837] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.837] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.838] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.838] SwitchToThread () returned 0 [0038.838] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.838] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.839] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.839] SwitchToThread () returned 0 [0038.839] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.839] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.839] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.840] SwitchToThread () returned 0 [0038.840] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.840] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.840] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.840] SwitchToThread () returned 0 [0038.840] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.841] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.841] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.841] SwitchToThread () returned 0 [0038.841] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.841] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.842] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.842] SwitchToThread () returned 0 [0038.842] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.842] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.843] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.843] SwitchToThread () returned 0 [0038.843] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.843] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.844] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.844] SwitchToThread () returned 0 [0038.844] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.844] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.845] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.845] SwitchToThread () returned 0 [0038.845] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.845] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.846] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.846] SwitchToThread () returned 0 [0038.846] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.846] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.847] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.847] SwitchToThread () returned 0 [0038.847] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.847] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.848] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.848] SwitchToThread () returned 0 [0038.848] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.848] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.849] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.849] SwitchToThread () returned 0 [0038.849] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.849] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.850] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.850] SwitchToThread () returned 0 [0038.850] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.850] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.851] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.851] SwitchToThread () returned 1 [0038.851] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.851] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.852] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.852] SwitchToThread () returned 0 [0038.852] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.852] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.853] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.853] SwitchToThread () returned 0 [0038.853] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.853] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.854] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.854] SwitchToThread () returned 0 [0038.854] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.854] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.855] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.855] SwitchToThread () returned 0 [0038.855] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.855] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.856] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.856] SwitchToThread () returned 0 [0038.856] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.856] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.857] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.857] SwitchToThread () returned 0 [0038.857] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.857] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.858] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.858] SwitchToThread () returned 0 [0038.858] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.858] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.859] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.859] SwitchToThread () returned 0 [0038.859] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.859] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.860] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.860] SwitchToThread () returned 0 [0038.860] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.860] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.861] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.861] SwitchToThread () returned 0 [0038.861] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.861] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.862] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.862] SwitchToThread () returned 0 [0038.862] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.862] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.863] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.863] SwitchToThread () returned 0 [0038.863] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.863] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.864] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.864] SwitchToThread () returned 0 [0038.864] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.864] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.865] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.865] SwitchToThread () returned 0 [0038.865] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.865] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.866] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.866] SwitchToThread () returned 0 [0038.866] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.866] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.867] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.867] SwitchToThread () returned 0 [0038.867] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.867] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.868] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.868] SwitchToThread () returned 0 [0038.868] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.868] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.869] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.869] SwitchToThread () returned 0 [0038.869] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.869] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.869] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.869] SwitchToThread () returned 0 [0038.869] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.870] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.870] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.870] SwitchToThread () returned 0 [0038.870] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.870] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.871] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.871] SwitchToThread () returned 0 [0038.871] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.871] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.872] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.872] SwitchToThread () returned 0 [0038.872] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.872] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.873] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.873] SwitchToThread () returned 0 [0038.873] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.873] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.874] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.874] SwitchToThread () returned 0 [0038.874] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.874] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.875] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.875] SwitchToThread () returned 1 [0038.875] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.875] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.876] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.876] SwitchToThread () returned 0 [0038.876] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.876] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.877] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.877] SwitchToThread () returned 0 [0038.877] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.877] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.878] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.878] SwitchToThread () returned 0 [0038.878] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.878] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.879] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.879] SwitchToThread () returned 0 [0038.879] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.879] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.886] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.886] SwitchToThread () returned 0 [0038.886] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.886] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.887] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.887] SwitchToThread () returned 0 [0038.887] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.887] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.888] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.888] SwitchToThread () returned 0 [0038.888] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.888] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.889] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.889] SwitchToThread () returned 0 [0038.889] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.889] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.890] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.890] SwitchToThread () returned 0 [0038.890] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.890] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.891] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.891] SwitchToThread () returned 0 [0038.891] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.891] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.892] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.892] SwitchToThread () returned 0 [0038.892] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.892] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.893] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.893] SwitchToThread () returned 0 [0038.893] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.893] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.893] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.893] SwitchToThread () returned 0 [0038.894] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.894] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.894] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.894] SwitchToThread () returned 0 [0038.894] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.894] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.895] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.895] SwitchToThread () returned 0 [0038.895] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.895] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.897] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.897] SwitchToThread () returned 0 [0038.897] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.897] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.898] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.898] SwitchToThread () returned 0 [0038.898] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.898] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.898] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.898] SwitchToThread () returned 0 [0038.898] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.899] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.899] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.899] SwitchToThread () returned 0 [0038.899] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.899] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.900] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.900] SwitchToThread () returned 0 [0038.900] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.900] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.901] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.901] SwitchToThread () returned 0 [0038.901] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.901] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.902] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.902] SwitchToThread () returned 0 [0038.902] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.902] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.903] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.903] SwitchToThread () returned 0 [0038.903] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.903] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.904] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.904] SwitchToThread () returned 0 [0038.904] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.904] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.905] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.905] SwitchToThread () returned 1 [0038.905] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.905] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.906] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.906] SwitchToThread () returned 0 [0038.906] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.906] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.907] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.907] SwitchToThread () returned 0 [0038.907] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.907] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.908] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.908] SwitchToThread () returned 0 [0038.908] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.909] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.909] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.909] SwitchToThread () returned 0 [0038.909] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.909] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.910] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.910] SwitchToThread () returned 0 [0038.910] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.910] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.911] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.912] SwitchToThread () returned 0 [0038.912] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.912] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.912] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.912] SwitchToThread () returned 0 [0038.913] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.913] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.913] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.913] SwitchToThread () returned 0 [0038.914] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.914] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.914] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.914] SwitchToThread () returned 0 [0038.915] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.915] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.915] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.915] SwitchToThread () returned 0 [0038.915] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.916] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.916] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.916] SwitchToThread () returned 0 [0038.916] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.916] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.917] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.917] SwitchToThread () returned 0 [0038.917] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.917] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.918] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.918] SwitchToThread () returned 0 [0038.918] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.918] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.919] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.919] SwitchToThread () returned 0 [0038.919] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.919] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.920] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.920] SwitchToThread () returned 0 [0038.920] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.920] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.921] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.921] SwitchToThread () returned 0 [0038.921] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.921] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.922] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.922] SwitchToThread () returned 0 [0038.922] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.922] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.923] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.923] SwitchToThread () returned 0 [0038.923] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.923] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.923] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.923] SwitchToThread () returned 0 [0038.923] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.924] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.924] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.924] SwitchToThread () returned 0 [0038.924] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.924] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.925] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.925] SwitchToThread () returned 0 [0038.925] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.925] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.926] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.926] SwitchToThread () returned 0 [0038.926] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.926] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.927] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.927] SwitchToThread () returned 0 [0038.928] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.928] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.928] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.928] SwitchToThread () returned 0 [0038.928] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.928] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.929] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.929] SwitchToThread () returned 1 [0038.929] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.929] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.930] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.930] SwitchToThread () returned 0 [0038.930] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.930] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.931] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.931] SwitchToThread () returned 0 [0038.931] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.931] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.932] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.932] SwitchToThread () returned 0 [0038.932] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.932] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.933] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.933] SwitchToThread () returned 0 [0038.933] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.933] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.934] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.934] SwitchToThread () returned 0 [0038.934] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.934] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.935] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.935] SwitchToThread () returned 0 [0038.935] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.935] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.936] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.936] SwitchToThread () returned 0 [0038.936] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.936] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.936] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.937] SwitchToThread () returned 0 [0038.937] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.937] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.937] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.937] SwitchToThread () returned 0 [0038.937] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.937] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.938] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.938] SwitchToThread () returned 0 [0038.938] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.938] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.939] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.939] SwitchToThread () returned 0 [0038.939] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.939] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.940] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.940] SwitchToThread () returned 0 [0038.940] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.940] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.941] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.941] SwitchToThread () returned 0 [0038.941] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.941] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.942] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.942] SwitchToThread () returned 0 [0038.942] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.942] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.943] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.943] SwitchToThread () returned 0 [0038.943] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.943] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.944] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.944] SwitchToThread () returned 0 [0038.944] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.944] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.945] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.945] SwitchToThread () returned 0 [0038.945] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.945] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.946] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.946] SwitchToThread () returned 0 [0038.946] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.946] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.947] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.947] SwitchToThread () returned 0 [0038.947] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.947] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.948] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.948] SwitchToThread () returned 0 [0038.948] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.948] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.949] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.949] SwitchToThread () returned 0 [0038.949] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.949] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.950] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.950] SwitchToThread () returned 0 [0038.950] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.950] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0038.951] CryptDecrypt (in: hKey=0x18f558, hHash=0x18f564, Final=1, dwFlags=0x18f558, pbData=0x18f564, pdwDataLen=0x18f564 | out: pbData=0x18f564, pdwDataLen=0x18f564) returned 0 [0038.951] SwitchToThread () returned 0 [0038.951] SetThreadPriorityBoost (hThread=0x18f564, bDisablePriorityBoost=1) returned 0 [0038.951] WriteProfileStringA (lpAppName="_WriteSippet", lpKeyName="LoseSuspect", lpString="KeepHalal") returned 1 [0175.646] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x61d218 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0175.651] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0175.651] CreateFileA (lpFileName="Rhizome" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\rhizome"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x50, hTemplateFile=0x0) returned 0x174 [0175.653] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d76e [0175.655] ReadFile (in: hFile=0x174, lpBuffer=0x658248, nNumberOfBytesToRead=0x2d76e, lpNumberOfBytesRead=0x18f618, lpOverlapped=0x0 | out: lpBuffer=0x658248*, lpNumberOfBytesRead=0x18f618*=0x2d76e, lpOverlapped=0x0) returned 1 [0175.658] CloseHandle (hObject=0x174) returned 1 [0175.661] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0175.661] GetModuleHandleA (lpModuleName="user32") returned 0x74f40000 [0175.661] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0175.661] GetTickCount () returned 0x3ae19 [0175.661] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0175.661] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0175.663] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0175.663] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0175.663] VirtualAlloc (lpAddress=0x0, dwSize=0x1db1, flAllocationType=0x3000, flProtect=0x40) returned 0x2f0000 [0175.664] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77130000 [0175.664] GetProcAddress (hModule=0x77130000, lpProcName="RtlDecompressBuffer") returned 0x771efded [0175.665] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0175.665] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0175.665] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0175.665] LocalAlloc (uFlags=0x40, uBytes=0x44) returned 0x5e5248 [0175.665] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x6018d8 [0175.665] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe\" " [0175.665] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0175.665] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0175.665] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsA") returned 0x76c4eb39 [0175.666] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0175.666] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0175.666] GetProcAddress (hModule=0x74f40000, lpProcName="wsprintfA") returned 0x74f6ae5f [0175.666] ExpandEnvironmentStringsA (in: lpSrc="%APPDATA%\\%s.exe", lpDst=0x611270, nSize=0x100 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\%s.exe") returned 0x35 [0175.666] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileA") returned 0x76c558e5 [0175.666] wsprintfA (in: param_1=0x611168, param_2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\%s.exe" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\entail.exe") returned 56 [0175.666] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6019e0, nSize=0x100 | out: lpFilename="") returned 0x0 [0175.666] lstrcatA (in: lpString1="", lpString2="" | out: lpString1="") returned="" [0175.666] lstrcmpiA (lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\entail.exe") returned -1 [0175.666] GetProcAddress (hModule=0x76c20000, lpProcName="IsWow64Process") returned 0x76c3195e [0175.667] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryA") returned 0x76c4b66c [0175.667] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0175.667] GetCurrentProcess () returned 0xffffffff [0175.667] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f614 | out: Wow64Process=0x18f614) returned 1 [0175.667] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemWow64DirectoryA") returned 0x76cb2404 [0175.668] GetSystemWow64DirectoryA (in: lpBuffer=0x6019e0, uSize=0x100 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0175.668] lstrcatA (in: lpString1="C:\\Windows\\SysWOW64", lpString2="wecutil.exe" | out: lpString1="C:\\Windows\\SysWOW64wecutil.exe") returned="C:\\Windows\\SysWOW64wecutil.exe" [0175.668] GetProcAddress (hModule=0x76c20000, lpProcName="WriteProcessMemory") returned 0x76c4d9e0 [0175.668] GetProcAddress (hModule=0x76c20000, lpProcName="CreateRemoteThread") returned 0x76cb416b [0175.668] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAllocEx") returned 0x76c4d9b0 [0175.668] VirtualAlloc (lpAddress=0x0, dwSize=0x8a9b, flAllocationType=0x3000, flProtect=0x40) returned 0x300000 [0175.671] GetSystemDirectoryW (in: lpBuffer=0x18edd8, uSize=0x230 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.672] CreateFileW (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0175.672] CreateFileMappingW (hFile=0x174, lpFileMappingAttributes=0x0, flProtect=0x1000002, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x178 [0175.672] MapViewOfFile (hFileMappingObject=0x178, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3190000 [0175.690] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ec44 | out: Wow64Process=0x18ec44) returned 1 [0175.692] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18e368, ProcessInformationLength=0x8, ReturnLength=0x18e338 | out: ProcessInformation=0x18e368, ReturnLength=0x18e338) returned 0x0 [0175.693] DbgPrint (Format=0x18e12c, param_2=0x7b1) returned 0x0 [0175.693] NtWow64QueryInformationProcess64 (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x0, ProcessInformation64=0x18ea58, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation64=0x18ea58, ReturnLength=0x0) returned 0x0 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7efdf018, Buffer=0x18dadc, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18dadc*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x77082640, Buffer=0x18db0c, NumberOfBytesToRead=0x40, NumberOfBytesRead=0x0 | out: Buffer=0x18db0c*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x342790, Buffer=0x18df64, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18df64*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] GetSystemDirectoryW (in: lpBuffer=0x18db4c, uSize=0x208 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x3428d0, Buffer=0x18da2c, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18da2c*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] lstrcmpiW (lpString1="C:\\Windows\\SYSTEM32\\ntdll.dll", lpString2="C:\\Windows\\system32\\ntdll.dll") returned 0 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x76f5003c, Buffer=0x18d930, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x18d930*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x76f500e6, Buffer=0x18d920, NumberOfBytesToRead=0x2, NumberOfBytesRead=0x0 | out: Buffer=0x18d920*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x76f501e8, Buffer=0x18d8b8, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x18d8b8*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x76f501f4, Buffer=0x18df6c, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x18df6c*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x76f501f0, Buffer=0x18daec, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x18daec*, NumberOfBytesRead=0x0) returned 0x0 [0175.693] RtlWow64EnableFsRedirectionEx () returned 0x0 [0175.695] CreateFileW (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0175.695] CreateFileMappingW (hFile=0x134, lpFileMappingAttributes=0x0, flProtect=0x1000002, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x13c [0175.695] MapViewOfFile (hFileMappingObject=0x13c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3310000 [0175.695] RtlWow64EnableFsRedirectionEx () returned 0x0 [0175.695] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e09c*=0x76f51000, NumberOfBytesToProtect=0x18df7c, NewAccessProtection=0x40, OldAccessProtection=0x18dfec | out: BaseAddress=0x18e09c*=0x76f51000, NumberOfBytesToProtect=0x18df7c, OldAccessProtection=0x18dfec*=0x20) returned 0x0 [0175.698] NtWriteVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0176.926] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e09c*=0x76f51000, NumberOfBytesToProtect=0x18df7c, NewAccessProtection=0x20, OldAccessProtection=0x18dfec | out: BaseAddress=0x18e09c*=0x76f51000, NumberOfBytesToProtect=0x18df7c, OldAccessProtection=0x18dfec*=0x40) returned 0x0 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7efdf018, Buffer=0x18dadc, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18dadc*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x77082640, Buffer=0x18db0c, NumberOfBytesToRead=0x40, NumberOfBytesRead=0x0 | out: Buffer=0x18db0c*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x342790, Buffer=0x18df64, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18df64*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] GetSystemDirectoryW (in: lpBuffer=0x18db4c, uSize=0x208 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x3428d0, Buffer=0x18da2c, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18da2c*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] lstrcmpiW (lpString1="C:\\Windows\\SYSTEM32\\ntdll.dll", lpString2="C:\\Windows\\system32\\wow64cpu.dll") returned -1 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x342880, Buffer=0x18e0a4, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18e0a4*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x342e80, Buffer=0x18da2c, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18da2c*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] lstrcmpiW (lpString1="C:\\Windows\\SYSTEM32\\wow64.dll", lpString2="C:\\Windows\\system32\\wow64cpu.dll") returned -1 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x342e30, Buffer=0x18e0a4, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18e0a4*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x343040, Buffer=0x18da2c, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18da2c*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] lstrcmpiW (lpString1="C:\\Windows\\SYSTEM32\\wow64win.dll", lpString2="C:\\Windows\\system32\\wow64cpu.dll") returned 1 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x342ff0, Buffer=0x18e0a4, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18e0a4*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x342d00, Buffer=0x18da2c, NumberOfBytesToRead=0x8, NumberOfBytesRead=0x0 | out: Buffer=0x18da2c*, NumberOfBytesRead=0x0) returned 0x0 [0176.930] lstrcmpiW (lpString1="C:\\Windows\\SYSTEM32\\wow64cpu.dll", lpString2="C:\\Windows\\system32\\wow64cpu.dll") returned 0 [0176.930] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7466003c, Buffer=0x18d930, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x18d930*, NumberOfBytesRead=0x0) returned 0x0 [0176.931] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x746600f6, Buffer=0x18d920, NumberOfBytesToRead=0x2, NumberOfBytesRead=0x0 | out: Buffer=0x18d920*, NumberOfBytesRead=0x0) returned 0x0 [0176.931] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x746601f8, Buffer=0x18d8b8, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x18d8b8*, NumberOfBytesRead=0x0) returned 0x0 [0176.931] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x74660204, Buffer=0x18df6c, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x18df6c*, NumberOfBytesRead=0x0) returned 0x0 [0176.931] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x74660200, Buffer=0x18daec, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x18daec*, NumberOfBytesRead=0x0) returned 0x0 [0176.931] RtlWow64EnableFsRedirectionEx () returned 0x0 [0176.932] CreateFileW (lpFileName="C:\\Windows\\system32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0176.932] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x1000002, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x188 [0176.932] MapViewOfFile (hFileMappingObject=0x188, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x310000 [0176.932] RtlWow64EnableFsRedirectionEx () returned 0x0 [0176.932] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e09c*=0x74661000, NumberOfBytesToProtect=0x18df7c, NewAccessProtection=0x40, OldAccessProtection=0x18dfec | out: BaseAddress=0x18e09c*=0x74661000, NumberOfBytesToProtect=0x18df7c, OldAccessProtection=0x18dfec*=0x20) returned 0x0 [0176.933] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18daf4*=0x0, ZeroBits=0x0, RegionSize=0x18e0bc*=0x246a, AllocationType=0x1000, Protect=0x40 | out: BaseAddress=0x18daf4*=0x320000, RegionSize=0x18e0bc*=0x3000) returned 0x0 [0176.933] NtReadVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x74661000, Buffer=0x320000, NumberOfBytesToRead=0x246a, NumberOfBytesRead=0x0 | out: Buffer=0x320000*, NumberOfBytesRead=0x0) returned 0x0 [0176.933] NtWriteVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x74661000, Buffer=0x320000*, NumberOfBytesToWrite=0x246a, NumberOfBytesWritten=0x0 | out: Buffer=0x320000*, NumberOfBytesWritten=0x0) returned 0x0 [0176.943] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e09c*=0x74661000, NumberOfBytesToProtect=0x18df7c, NewAccessProtection=0x20, OldAccessProtection=0x18dfec | out: BaseAddress=0x18e09c*=0x74661000, NumberOfBytesToProtect=0x18df7c, OldAccessProtection=0x18dfec*=0x40) returned 0x0 [0176.943] DbgPrint (Format=0x18e12c, param_2=0x7cc) returned 0x0 [0176.962] DbgPrint (Format=0x18e12c, param_2=0x80c) returned 0x0 [0176.983] DbgPrint (Format=0x18e12c, param_2=0x83f) returned 0x0 [0176.984] LdrGetProcedureAddress (in: BaseAddress=0x755e0000, Name="CoCreateInstance", Ordinal=0x0, ProcedureAddress=0x18f384 | out: ProcedureAddress=0x18f384*=0x75629d0b) returned 0x0 [0176.984] DbgPrint (Format=0x18e12c, param_2=0x857) returned 0x0 [0176.984] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18e318, ProcessInformationLength=0x8, ReturnLength=0x18e2e8 | out: ProcessInformation=0x18e318, ReturnLength=0x18e2e8) returned 0x0 [0176.984] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18ea18*=0x0, ZeroBits=0x0, RegionSize=0x18ec6c*=0x20000, AllocationType=0x1000, Protect=0x40 | out: BaseAddress=0x18ea18*=0x1d50000, RegionSize=0x18ec6c*=0x20000) returned 0x0 [0176.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1d50000, Length=0x20000, ResultLength=0x18ec6c | out: SystemInformation=0x1d50000, ResultLength=0x18ec6c*=0x8d08) returned 0x0 [0176.986] lstrcmpiW (lpString1=0x0, lpString2="ekrn.exe") returned -1 [0176.986] lstrcmpiW (lpString1=0x0, lpString2="avp.exe") returned -1 [0176.986] lstrcmpiW (lpString1="System", lpString2="ekrn.exe") returned 1 [0176.986] lstrcmpiW (lpString1="System", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="smss.exe", lpString2="ekrn.exe") returned 1 [0176.986] lstrcmpiW (lpString1="smss.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0176.986] lstrcmpiW (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="wininit.exe", lpString2="ekrn.exe") returned 1 [0176.986] lstrcmpiW (lpString1="wininit.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0176.986] lstrcmpiW (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="winlogon.exe", lpString2="ekrn.exe") returned 1 [0176.986] lstrcmpiW (lpString1="winlogon.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="services.exe", lpString2="ekrn.exe") returned 1 [0176.986] lstrcmpiW (lpString1="services.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="lsass.exe", lpString2="ekrn.exe") returned 1 [0176.986] lstrcmpiW (lpString1="lsass.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="lsm.exe", lpString2="ekrn.exe") returned 1 [0176.986] lstrcmpiW (lpString1="lsm.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.986] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.986] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="audiodg.exe", lpString2="ekrn.exe") returned -1 [0176.987] lstrcmpiW (lpString1="audiodg.exe", lpString2="avp.exe") returned -1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="dwm.exe", lpString2="ekrn.exe") returned -1 [0176.987] lstrcmpiW (lpString1="dwm.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="explorer.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="explorer.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="spoolsv.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="spoolsv.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="taskhost.exe", lpString2="ekrn.exe") returned 1 [0176.987] lstrcmpiW (lpString1="taskhost.exe", lpString2="avp.exe") returned 1 [0176.987] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="taskeng.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="taskeng.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="treasury.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="treasury.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="tony-optical-therapist.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="tony-optical-therapist.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="matingwashaccommodations.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="matingwashaccommodations.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="kill.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="kill.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="wrestling proud repair.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="wrestling proud repair.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="catalog.exe", lpString2="ekrn.exe") returned -1 [0176.988] lstrcmpiW (lpString1="catalog.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="fee watt.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="fee watt.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="lawrence pm.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="lawrence pm.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="partner-keeps.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="partner-keeps.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="stunning.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="stunning.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="harvard.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="harvard.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="flat.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="flat.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="spend-huge-fell.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="spend-huge-fell.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="prototype_downtown_columns.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="prototype_downtown_columns.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="specialized_test.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="specialized_test.exe", lpString2="avp.exe") returned 1 [0176.988] lstrcmpiW (lpString1="hi-graduated.exe", lpString2="ekrn.exe") returned 1 [0176.988] lstrcmpiW (lpString1="hi-graduated.exe", lpString2="avp.exe") returned 1 [0176.989] lstrcmpiW (lpString1="cases_surprising_essentially.exe", lpString2="ekrn.exe") returned -1 [0176.989] lstrcmpiW (lpString1="cases_surprising_essentially.exe", lpString2="avp.exe") returned 1 [0176.989] lstrcmpiW (lpString1="cleaners.exe", lpString2="ekrn.exe") returned -1 [0176.989] lstrcmpiW (lpString1="cleaners.exe", lpString2="avp.exe") returned 1 [0176.989] lstrcmpiW (lpString1="WmiPrvSE.exe", lpString2="ekrn.exe") returned 1 [0176.989] lstrcmpiW (lpString1="WmiPrvSE.exe", lpString2="avp.exe") returned 1 [0176.989] lstrcmpiW (lpString1="greencrypt_crypt.exe", lpString2="ekrn.exe") returned 1 [0176.989] lstrcmpiW (lpString1="greencrypt_crypt.exe", lpString2="avp.exe") returned 1 [0176.989] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.989] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.989] lstrcmpiW (lpString1="sppsvc.exe", lpString2="ekrn.exe") returned 1 [0176.989] lstrcmpiW (lpString1="sppsvc.exe", lpString2="avp.exe") returned 1 [0176.989] lstrcmpiW (lpString1="svchost.exe", lpString2="ekrn.exe") returned 1 [0176.989] lstrcmpiW (lpString1="svchost.exe", lpString2="avp.exe") returned 1 [0176.989] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x1e, ProcessInformation=0x18e2c8, ProcessInformationLength=0x8, ReturnLength=0x18e298 | out: ProcessInformation=0x18e2c8, ReturnLength=0x18e298) returned 0xc0000353 [0176.989] DbgPrint (Format=0x18e12c, param_2=0x889) returned 0x0 [0176.989] _swprintf (in: param_1=0x1d50000, param_2="%x.tmp" | out: param_1="be47d02.tmp") returned 11 [0176.993] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771dcb92, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x40, OldAccessProtection=0x18e0a8 | out: BaseAddress=0x18e0dc*=0x771dc000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e0a8*=0x20) returned 0x0 [0176.993] NtWriteVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e02c | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e02c*=0x5) returned 0x0 [0176.993] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771dcb92, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x20, OldAccessProtection=0x18e09c | out: BaseAddress=0x18e0dc*=0x771dc000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e09c*=0x40) returned 0x0 [0176.994] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771dcaf5, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x40, OldAccessProtection=0x18e0a8 | out: BaseAddress=0x18e0dc*=0x771dc000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e0a8*=0x20) returned 0x0 [0176.994] NtWriteVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e02c | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e02c*=0x5) returned 0x0 [0176.994] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771dcaf5, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x20, OldAccessProtection=0x18e09c | out: BaseAddress=0x18e0dc*=0x771dc000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e09c*=0x40) returned 0x0 [0177.004] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771a1e1d, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x40, OldAccessProtection=0x18e0a8 | out: BaseAddress=0x18e0dc*=0x771a1000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e0a8*=0x20) returned 0x0 [0177.004] NtWriteVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e02c | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e02c*=0x5) returned 0x0 [0177.005] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771a1e1d, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x20, OldAccessProtection=0x18e09c | out: BaseAddress=0x18e0dc*=0x771a1000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e09c*=0x40) returned 0x0 [0177.008] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771abfa0, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x40, OldAccessProtection=0x18e0a8 | out: BaseAddress=0x18e0dc*=0x771ab000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e0a8*=0x20) returned 0x0 [0177.008] NtWriteVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e02c | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e02c*=0x5) returned 0x0 [0177.009] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771abfa0, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x20, OldAccessProtection=0x18e09c | out: BaseAddress=0x18e0dc*=0x771ab000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e09c*=0x40) returned 0x0 [0177.009] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771ac0e0, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x40, OldAccessProtection=0x18e0a8 | out: BaseAddress=0x18e0dc*=0x771ac000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e0a8*=0x20) returned 0x0 [0177.009] NtWriteVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e02c | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e02c*=0x5) returned 0x0 [0177.009] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e0dc*=0x771ac0e0, NumberOfBytesToProtect=0x18e03c, NewAccessProtection=0x20, OldAccessProtection=0x18e09c | out: BaseAddress=0x18e0dc*=0x771ac000, NumberOfBytesToProtect=0x18e03c, OldAccessProtection=0x18e09c*=0x40) returned 0x0 [0177.009] RtlCreateUnicodeStringFromAsciiz (in: Destination=0x18f540, Source="wecutil.exe" | out: Destination="wecutil.exe") returned 1 [0177.009] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18ecd4*=0x0, ZeroBits=0x0, RegionSize=0x18f294*=0x1000, AllocationType=0x1000, Protect=0x40 | out: BaseAddress=0x18ecd4*=0x1d70000, RegionSize=0x18f294*=0x1000) returned 0x0 [0177.012] RtlInitUnicodeString (in: DestinationString=0x18e124, SourceString="TMP" | out: DestinationString="TMP") [0177.012] RtlQueryEnvironmentVariable_U (in: Environment=0x0, Name="TMP", Value=0x18e11c | out: Value="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x0 [0177.015] RtlInitUnicodeString (in: DestinationString=0x18e124, SourceString="TMP" | out: DestinationString="TMP") [0177.015] RtlQueryEnvironmentVariable_U (in: Environment=0x0, Name="TMP", Value=0x18e11c | out: Value="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x0 [0177.015] _swprintf (in: param_1=0x1d70400, param_2="%x.lnk" | out: param_1="bfc8f96.lnk") returned 11 [0177.015] _swprintf (in: param_1=0x1d70800, param_2="%s" | out: param_1="wecutil.exe") returned 11 [0177.015] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1d70a00 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0177.017] DbgPrint (Format=0x18e12c, param_2=0x8a9) returned 0x0 [0177.017] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc11e3f60, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xc11e3f60, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61c960 [0177.017] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc11e3f60, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xc11e3f60, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.019] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5cf6aaf0, ftCreationTime.dwHighDateTime=0x1d4c769, ftLastAccessTime.dwLowDateTime=0x390f60d0, ftLastAccessTime.dwHighDateTime=0x1d4cc0c, ftLastWriteTime.dwLowDateTime=0x390f60d0, ftLastWriteTime.dwHighDateTime=0x1d4cc0c, nFileSizeHigh=0x0, nFileSizeLow=0x5b57, dwReserved0=0x0, dwReserved1=0x0, cFileName="-3eIjbC8.csv", cAlternateFileName="")) returned 1 [0177.019] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f0f0e50, ftCreationTime.dwHighDateTime=0x1d4c8c8, ftLastAccessTime.dwLowDateTime=0xdd3c0560, ftLastAccessTime.dwHighDateTime=0x1d4d5a7, ftLastWriteTime.dwLowDateTime=0xdd3c0560, ftLastWriteTime.dwHighDateTime=0x1d4d5a7, nFileSizeHigh=0x0, nFileSizeLow=0x15221, dwReserved0=0x0, dwReserved1=0x0, cFileName="26sNF2vV95bz.mp3", cAlternateFileName="26SNF2~1.MP3")) returned 1 [0177.019] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1417ec0, ftCreationTime.dwHighDateTime=0x1d4c5e1, ftLastAccessTime.dwLowDateTime=0x7e9a3860, ftLastAccessTime.dwHighDateTime=0x1d4c670, ftLastWriteTime.dwLowDateTime=0x7e9a3860, ftLastWriteTime.dwHighDateTime=0x1d4c670, nFileSizeHigh=0x0, nFileSizeLow=0x17397, dwReserved0=0x0, dwReserved1=0x0, cFileName="69Dcvw.avi", cAlternateFileName="")) returned 1 [0177.019] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1123e850, ftCreationTime.dwHighDateTime=0x1d4cce5, ftLastAccessTime.dwLowDateTime=0x5d830250, ftLastAccessTime.dwHighDateTime=0x1d4c95f, ftLastWriteTime.dwLowDateTime=0x5d830250, ftLastWriteTime.dwHighDateTime=0x1d4c95f, nFileSizeHigh=0x0, nFileSizeLow=0x1426b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7_JYv6pwdGozPchuvM4u.mkv", cAlternateFileName="7_JYV6~1.MKV")) returned 1 [0177.019] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa42864e0, ftCreationTime.dwHighDateTime=0x1d4d4ca, ftLastAccessTime.dwLowDateTime=0x24733cd0, ftLastAccessTime.dwHighDateTime=0x1d4d15e, ftLastWriteTime.dwLowDateTime=0x24733cd0, ftLastWriteTime.dwHighDateTime=0x1d4d15e, nFileSizeHigh=0x0, nFileSizeLow=0x13019, dwReserved0=0x0, dwReserved1=0x0, cFileName="89aQ_1loDnm-.csv", cAlternateFileName="89AQ_1~1.CSV")) returned 1 [0177.019] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0177.019] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61d558 [0177.021] FindNextFileW (in: hFindFile=0x61d558, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.022] FindNextFileW (in: hFindFile=0x61d558, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0177.022] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61d598 [0177.022] FindNextFileW (in: hFindFile=0x61d598, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.022] FindNextFileW (in: hFindFile=0x61d598, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0177.022] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61d5d8 [0177.023] FindNextFileW (in: hFindFile=0x61d5d8, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.023] FindNextFileW (in: hFindFile=0x61d5d8, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0177.023] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e2880 [0177.024] FindNextFileW (in: hFindFile=0x5e2880, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.024] FindNextFileW (in: hFindFile=0x5e2880, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.024] FindNextFileW (in: hFindFile=0x61d5d8, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0177.024] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e28c0 [0177.024] FindNextFileW (in: hFindFile=0x5e28c0, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.025] FindNextFileW (in: hFindFile=0x5e28c0, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.025] FindNextFileW (in: hFindFile=0x61d5d8, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0177.025] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e2900 [0177.026] FindNextFileW (in: hFindFile=0x5e2900, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.026] FindNextFileW (in: hFindFile=0x5e2900, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0177.026] FindNextFileW (in: hFindFile=0x5e2900, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0177.026] FindNextFileW (in: hFindFile=0x5e2900, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0177.026] FindNextFileW (in: hFindFile=0x61d5d8, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0177.026] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x691150 [0177.026] FindNextFileW (in: hFindFile=0x691150, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.026] FindNextFileW (in: hFindFile=0x691150, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0177.026] FindNextFileW (in: hFindFile=0x691150, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0177.026] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18d24c | out: lpFindFileData=0x18d24c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692198 [0177.027] FindNextFileW (in: hFindFile=0x692198, lpFindFileData=0x18d24c | out: lpFindFileData=0x18d24c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x692198, lpFindFileData=0x18d24c | out: lpFindFileData=0x18d24c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x692198, lpFindFileData=0x18d24c | out: lpFindFileData=0x18d24c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x692198, lpFindFileData=0x18d24c | out: lpFindFileData=0x18d24c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0 [0177.027] FindNextFileW (in: hFindFile=0x691150, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0177.027] FindNextFileW (in: hFindFile=0x61d5d8, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0177.028] FindNextFileW (in: hFindFile=0x61d598, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0177.028] FindNextFileW (in: hFindFile=0x61d558, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0177.028] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6931e0 [0177.028] FindNextFileW (in: hFindFile=0x6931e0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.029] FindNextFileW (in: hFindFile=0x6931e0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0177.029] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x694228 [0177.030] FindNextFileW (in: hFindFile=0x694228, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.030] FindNextFileW (in: hFindFile=0x694228, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0177.030] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695270 [0177.030] FindNextFileW (in: hFindFile=0x695270, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.031] FindNextFileW (in: hFindFile=0x695270, lpFindFileData=0x18d4c4 | out: lpFindFileData=0x18d4c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.031] FindNextFileW (in: hFindFile=0x694228, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0177.031] FindNextFileW (in: hFindFile=0x6931e0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0177.031] FindNextFileW (in: hFindFile=0x61d558, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0177.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6962b8 [0177.031] FindNextFileW (in: hFindFile=0x6962b8, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.031] FindNextFileW (in: hFindFile=0x6962b8, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.031] FindNextFileW (in: hFindFile=0x61d558, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0177.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x697300 [0177.032] FindNextFileW (in: hFindFile=0x697300, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x697300, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0177.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x698360 [0177.033] FindNextFileW (in: hFindFile=0x698360, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x698360, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.033] FindNextFileW (in: hFindFile=0x697300, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0177.033] FindNextFileW (in: hFindFile=0x61d558, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0177.033] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6983a0 [0177.033] FindNextFileW (in: hFindFile=0x6983a0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x6983a0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.033] FindNextFileW (in: hFindFile=0x61d558, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0177.033] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29e71a0, ftCreationTime.dwHighDateTime=0x1d4ce08, ftLastAccessTime.dwLowDateTime=0x1b31d1d0, ftLastAccessTime.dwHighDateTime=0x1d4cba1, ftLastWriteTime.dwLowDateTime=0x1b31d1d0, ftLastWriteTime.dwHighDateTime=0x1d4cba1, nFileSizeHigh=0x0, nFileSizeLow=0xa565, dwReserved0=0x0, dwReserved1=0x0, cFileName="cHsVzyifky7rsYWE.wav", cAlternateFileName="CHSVZY~1.WAV")) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f9452e0, ftCreationTime.dwHighDateTime=0x1d4c53d, ftLastAccessTime.dwLowDateTime=0x42e8bfb0, ftLastAccessTime.dwHighDateTime=0x1d4d432, ftLastWriteTime.dwLowDateTime=0x42e8bfb0, ftLastWriteTime.dwHighDateTime=0x1d4d432, nFileSizeHigh=0x0, nFileSizeLow=0x136cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="E1OA18.mkv", cAlternateFileName="")) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2bcba80, ftCreationTime.dwHighDateTime=0x1d4c770, ftLastAccessTime.dwLowDateTime=0xe7ed03d0, ftLastAccessTime.dwHighDateTime=0x1d4d0cd, ftLastWriteTime.dwLowDateTime=0xe7ed03d0, ftLastWriteTime.dwHighDateTime=0x1d4d0cd, nFileSizeHigh=0x0, nFileSizeLow=0x16725, dwReserved0=0x0, dwReserved1=0x0, cFileName="eDWiuEkautI.jpg", cAlternateFileName="EDWIUE~1.JPG")) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc86798c0, ftCreationTime.dwHighDateTime=0x1d4d2f5, ftLastAccessTime.dwLowDateTime=0xd8db1710, ftLastAccessTime.dwHighDateTime=0x1d4ce66, ftLastWriteTime.dwLowDateTime=0xd8db1710, ftLastWriteTime.dwHighDateTime=0x1d4ce66, nFileSizeHigh=0x0, nFileSizeLow=0x1d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fdjf9_sf0.avi", cAlternateFileName="FDJF9_~1.AVI")) returned 1 [0177.034] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd10090a0, ftCreationTime.dwHighDateTime=0x1d4c90d, ftLastAccessTime.dwLowDateTime=0x526271e0, ftLastAccessTime.dwHighDateTime=0x1d4cfe9, ftLastWriteTime.dwLowDateTime=0x526271e0, ftLastWriteTime.dwHighDateTime=0x1d4cfe9, nFileSizeHigh=0x0, nFileSizeLow=0xf1f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="i-hyT0Ls-cHOf-a5.avi", cAlternateFileName="I-HYT0~1.AVI")) returned 1 [0177.034] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0177.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6983e0 [0177.034] FindNextFileW (in: hFindFile=0x6983e0, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.034] FindNextFileW (in: hFindFile=0x6983e0, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0177.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x698420 [0177.035] FindNextFileW (in: hFindFile=0x698420, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.036] FindNextFileW (in: hFindFile=0x698420, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.036] FindNextFileW (in: hFindFile=0x6983e0, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0177.036] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6712ac30, ftCreationTime.dwHighDateTime=0x1d4c7fc, ftLastAccessTime.dwLowDateTime=0x3dc4fcb0, ftLastAccessTime.dwHighDateTime=0x1d4c645, ftLastWriteTime.dwLowDateTime=0x3dc4fcb0, ftLastWriteTime.dwHighDateTime=0x1d4c645, nFileSizeHigh=0x0, nFileSizeLow=0x4b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="laadQ3RUHgHSVugI.m4a", cAlternateFileName="LAADQ3~1.M4A")) returned 1 [0177.037] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x139fa1a0, ftCreationTime.dwHighDateTime=0x1d4d483, ftLastAccessTime.dwLowDateTime=0xd7faef00, ftLastAccessTime.dwHighDateTime=0x1d4cf10, ftLastWriteTime.dwLowDateTime=0xd7faef00, ftLastWriteTime.dwHighDateTime=0x1d4cf10, nFileSizeHigh=0x0, nFileSizeLow=0x6874, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1hX134WAvzWi8k5.gif", cAlternateFileName="M1HX13~1.GIF")) returned 1 [0177.037] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0177.037] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x698460 [0177.038] FindNextFileW (in: hFindFile=0x698460, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.038] FindNextFileW (in: hFindFile=0x698460, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0177.038] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6984a0 [0177.038] FindNextFileW (in: hFindFile=0x6984a0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.038] FindNextFileW (in: hFindFile=0x6984a0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0177.038] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6984e0 [0177.039] FindNextFileW (in: hFindFile=0x6984e0, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x6984e0, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x6984e0, lpFindFileData=0x18d73c | out: lpFindFileData=0x18d73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0177.039] FindNextFileW (in: hFindFile=0x6984a0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x6984a0, lpFindFileData=0x18d9b4 | out: lpFindFileData=0x18d9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0177.039] FindNextFileW (in: hFindFile=0x698460, lpFindFileData=0x18dc2c | out: lpFindFileData=0x18dc2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52961380, ftCreationTime.dwHighDateTime=0x1d4d564, ftLastAccessTime.dwLowDateTime=0x90bdaf50, ftLastAccessTime.dwHighDateTime=0x1d4cf84, ftLastWriteTime.dwLowDateTime=0x90bdaf50, ftLastWriteTime.dwHighDateTime=0x1d4cf84, nFileSizeHigh=0x0, nFileSizeLow=0x5f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="n9rp.mp3", cAlternateFileName="")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe1ac9930, ftCreationTime.dwHighDateTime=0x1d4d0b5, ftLastAccessTime.dwLowDateTime=0xe92c370, ftLastAccessTime.dwHighDateTime=0x1d4d4b7, ftLastWriteTime.dwLowDateTime=0xe92c370, ftLastWriteTime.dwHighDateTime=0x1d4d4b7, nFileSizeHigh=0x0, nFileSizeLow=0xc3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OpiS3UBRke3K12rJ C3.jpg", cAlternateFileName="OPIS3U~1.JPG")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34dd6e30, ftCreationTime.dwHighDateTime=0x1d4c95f, ftLastAccessTime.dwLowDateTime=0x17c950e0, ftLastAccessTime.dwHighDateTime=0x1d4d01f, ftLastWriteTime.dwLowDateTime=0x17c950e0, ftLastWriteTime.dwHighDateTime=0x1d4d01f, nFileSizeHigh=0x0, nFileSizeLow=0xe7c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OS6h5.avi", cAlternateFileName="")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8051cb0, ftCreationTime.dwHighDateTime=0x1d4ce2f, ftLastAccessTime.dwLowDateTime=0xc0f040, ftLastAccessTime.dwHighDateTime=0x1d4c86a, ftLastWriteTime.dwLowDateTime=0xc0f040, ftLastWriteTime.dwHighDateTime=0x1d4c86a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="pG13X-VRjKkKI8vyOW.jpg", cAlternateFileName="PG13X-~1.JPG")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xff1c0cc0, ftCreationTime.dwHighDateTime=0x1d4ca80, ftLastAccessTime.dwLowDateTime=0xf0494790, ftLastAccessTime.dwHighDateTime=0x1d4c9a8, ftLastWriteTime.dwLowDateTime=0xf0494790, ftLastWriteTime.dwHighDateTime=0x1d4c9a8, nFileSizeHigh=0x0, nFileSizeLow=0x12f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PzvrlNZBBqiYX8dU.swf", cAlternateFileName="PZVRLN~1.SWF")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c4c8430, ftCreationTime.dwHighDateTime=0x1d4cdb0, ftLastAccessTime.dwLowDateTime=0x67cf4900, ftLastAccessTime.dwHighDateTime=0x1d4cd2c, ftLastWriteTime.dwLowDateTime=0x67cf4900, ftLastWriteTime.dwHighDateTime=0x1d4cd2c, nFileSizeHigh=0x0, nFileSizeLow=0x3bf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QFY9TpD.rtf", cAlternateFileName="")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb305e780, ftCreationTime.dwHighDateTime=0x1d4d439, ftLastAccessTime.dwLowDateTime=0x5f96340, ftLastAccessTime.dwHighDateTime=0x1d4d0f2, ftLastWriteTime.dwLowDateTime=0x5f96340, ftLastWriteTime.dwHighDateTime=0x1d4d0f2, nFileSizeHigh=0x0, nFileSizeLow=0x4c94, dwReserved0=0x0, dwReserved1=0x0, cFileName="qnyJUn.bmp", cAlternateFileName="")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f6aa870, ftCreationTime.dwHighDateTime=0x1d4c72c, ftLastAccessTime.dwLowDateTime=0xaaaa1d30, ftLastAccessTime.dwHighDateTime=0x1d4ce5e, ftLastWriteTime.dwLowDateTime=0xaaaa1d30, ftLastWriteTime.dwHighDateTime=0x1d4ce5e, nFileSizeHigh=0x0, nFileSizeLow=0x12f0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="QoAau_APBooymRV24Y2.png", cAlternateFileName="QOAAU_~1.PNG")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16cf08d0, ftCreationTime.dwHighDateTime=0x1d4cb31, ftLastAccessTime.dwLowDateTime=0x5eb6abd0, ftLastAccessTime.dwHighDateTime=0x1d4ca19, ftLastWriteTime.dwLowDateTime=0x5eb6abd0, ftLastWriteTime.dwHighDateTime=0x1d4ca19, nFileSizeHigh=0x0, nFileSizeLow=0x15d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="q_ YvoTgVKd37XsFM.gif", cAlternateFileName="Q_YVOT~1.GIF")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44b48630, ftCreationTime.dwHighDateTime=0x1d4cf28, ftLastAccessTime.dwLowDateTime=0xd4c91a70, ftLastAccessTime.dwHighDateTime=0x1d4c946, ftLastWriteTime.dwLowDateTime=0xd4c91a70, ftLastWriteTime.dwHighDateTime=0x1d4c946, nFileSizeHigh=0x0, nFileSizeLow=0x1233e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sNK9SNusYynqi.gif", cAlternateFileName="SNK9SN~1.GIF")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73c0ef20, ftCreationTime.dwHighDateTime=0x1d4ccc3, ftLastAccessTime.dwLowDateTime=0x3b7d70b0, ftLastAccessTime.dwHighDateTime=0x1d4ce27, ftLastWriteTime.dwLowDateTime=0x3b7d70b0, ftLastWriteTime.dwHighDateTime=0x1d4ce27, nFileSizeHigh=0x0, nFileSizeLow=0x7c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="V4KFzkWPxkCH4_n.csv", cAlternateFileName="V4KFZK~1.CSV")) returned 1 [0177.039] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54840110, ftCreationTime.dwHighDateTime=0x1d4c61f, ftLastAccessTime.dwLowDateTime=0xe5156130, ftLastAccessTime.dwHighDateTime=0x1d4c5f5, ftLastWriteTime.dwLowDateTime=0xe5156130, ftLastWriteTime.dwHighDateTime=0x1d4c5f5, nFileSizeHigh=0x0, nFileSizeLow=0x82c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="VP2tqP3i m1.mkv", cAlternateFileName="VP2TQP~1.MKV")) returned 1 [0177.040] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c5f4580, ftCreationTime.dwHighDateTime=0x1d4d465, ftLastAccessTime.dwLowDateTime=0x59c811c0, ftLastAccessTime.dwHighDateTime=0x1d4c570, ftLastWriteTime.dwLowDateTime=0x59c811c0, ftLastWriteTime.dwHighDateTime=0x1d4c570, nFileSizeHigh=0x0, nFileSizeLow=0x2f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="wCyaxKz0-XmY0wVAj.mp3", cAlternateFileName="WCYAXK~1.MP3")) returned 1 [0177.040] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24c18530, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0x99ac6bd0, ftLastAccessTime.dwHighDateTime=0x1d4d072, ftLastWriteTime.dwLowDateTime=0x99ac6bd0, ftLastWriteTime.dwHighDateTime=0x1d4d072, nFileSizeHigh=0x0, nFileSizeLow=0x180b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ye_oNjjY8T.xls", cAlternateFileName="YE_ONJ~1.XLS")) returned 1 [0177.040] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc4b420, ftCreationTime.dwHighDateTime=0x1d4cb5f, ftLastAccessTime.dwLowDateTime=0x76df5e50, ftLastAccessTime.dwHighDateTime=0x1d4cbe0, ftLastWriteTime.dwLowDateTime=0x76df5e50, ftLastWriteTime.dwHighDateTime=0x1d4cbe0, nFileSizeHigh=0x0, nFileSizeLow=0xbcdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="YjuKfDnWs9AVcVmF.mkv", cAlternateFileName="YJUKFD~1.MKV")) returned 1 [0177.040] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd262160, ftCreationTime.dwHighDateTime=0x1d4cafc, ftLastAccessTime.dwLowDateTime=0x260cc120, ftLastAccessTime.dwHighDateTime=0x1d4cd43, ftLastWriteTime.dwLowDateTime=0x260cc120, ftLastWriteTime.dwHighDateTime=0x1d4cd43, nFileSizeHigh=0x0, nFileSizeLow=0xca29, dwReserved0=0x0, dwReserved1=0x0, cFileName="zlijo0jZS7.jpg", cAlternateFileName="ZLIJO0~1.JPG")) returned 1 [0177.040] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2b166d0, ftCreationTime.dwHighDateTime=0x1d4d234, ftLastAccessTime.dwLowDateTime=0xaa919e70, ftLastAccessTime.dwHighDateTime=0x1d4c9c4, ftLastWriteTime.dwLowDateTime=0xaa919e70, ftLastWriteTime.dwHighDateTime=0x1d4c9c4, nFileSizeHigh=0x0, nFileSizeLow=0x15a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ztaZMrwhP7.m4a", cAlternateFileName="ZTAZMR~1.M4A")) returned 1 [0177.040] FindNextFileW (in: hFindFile=0x61c960, lpFindFileData=0x18dea4 | out: lpFindFileData=0x18dea4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2b166d0, ftCreationTime.dwHighDateTime=0x1d4d234, ftLastAccessTime.dwLowDateTime=0xaa919e70, ftLastAccessTime.dwHighDateTime=0x1d4c9c4, ftLastWriteTime.dwLowDateTime=0xaa919e70, ftLastWriteTime.dwHighDateTime=0x1d4c9c4, nFileSizeHigh=0x0, nFileSizeLow=0x15a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ztaZMrwhP7.m4a", cAlternateFileName="ZTAZMR~1.M4A")) returned 0 [0177.040] DbgPrint (Format=0x18e12c, param_2=0x8b5) returned 0x0 [0177.040] GetSystemDirectoryW (in: lpBuffer=0x18edd8, uSize=0x230 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0177.040] DbgPrint (Format=0x18e12c, param_2=0x8d9) returned 0x0 [0177.040] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\nslookup.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18ed50*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18ed9c | out: lpCommandLine=0x0, lpProcessInformation=0x18ed9c*(hProcess=0x1e4, hThread=0x1e0, dwProcessId=0x3b0, dwThreadId=0x90)) returned 1 [0177.160] DbgPrint (Format=0x18e12c, param_2=0x925) returned 0x0 [0177.160] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18f2a8*=0x0, ZeroBits=0x0, RegionSize=0x18ec78*=0x2cc, AllocationType=0x1000, Protect=0x40 | out: BaseAddress=0x18f2a8*=0x1d80000, RegionSize=0x18ec78*=0x1000) returned 0x0 [0177.160] DbgPrint (Format=0x18e12c, param_2=0x964) returned 0x0 [0177.161] NtGetContextThread (in: ThreadHandle=0x1e0, Context=0x1d80000 | out: Context=0x1d80000*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xdacc45, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0177.161] DbgPrint (Format=0x18e12c, param_2=0x96a) returned 0x0 [0177.161] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7efde008, Buffer=0x18f4f4, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x18ec88 | out: Buffer=0x18f4f4*, NumberOfBytesRead=0x18ec88*=0x4) returned 0x0 [0177.161] DbgPrint (Format=0x18e12c, param_2=0x96f) returned 0x0 [0177.161] NtAllocateVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18f3e8*=0x0, ZeroBits=0x0, RegionSize=0x18ebc0*=0x105c, AllocationType=0x3000, Protect=0x40 | out: BaseAddress=0x18f3e8*=0x70000, RegionSize=0x18ebc0*=0x2000) returned 0x0 [0177.161] DbgPrint (Format=0x18e12c, param_2=0x989) returned 0x0 [0177.161] lstrcmpiW (lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\wecutil.exe", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe") returned -1 [0177.161] RtlCreateUnicodeStringFromAsciiz (in: Destination=0x18ec90, Source="wecutil.exe" | out: Destination="wecutil.exe") returned 1 [0177.161] DbgPrint (Format=0x18e12c, param_2=0x996) returned 0x0 [0177.162] _swprintf (in: param_1=0x1d70600, param_2="%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe") returned 58 [0177.162] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x70800, Buffer=0x1d70600*, NumberOfBytesToWrite=0x76, NumberOfBytesWritten=0x18e10c | out: Buffer=0x1d70600*, NumberOfBytesWritten=0x18e10c*=0x76) returned 0x0 [0177.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\wecutil.exe") returned 74 [0177.162] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x70400, Buffer=0x5e3a78*, NumberOfBytesToWrite=0x96, NumberOfBytesWritten=0x18e10c | out: Buffer=0x5e3a78*, NumberOfBytesWritten=0x18e10c*=0x96) returned 0x0 [0177.162] lstrlenW (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bfc8f96.lnk") returned 48 [0177.162] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x70200, Buffer=0x1d70200*, NumberOfBytesToWrite=0x62, NumberOfBytesWritten=0x18e10c | out: Buffer=0x1d70200*, NumberOfBytesWritten=0x18e10c*=0x62) returned 0x0 [0177.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wecutil.lnk") returned 103 [0177.163] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x70600, Buffer=0x61d218*, NumberOfBytesToWrite=0xd0, NumberOfBytesWritten=0x18e10c | out: Buffer=0x61d218*, NumberOfBytesWritten=0x18e10c*=0xd0) returned 0x0 [0177.163] lstrlenW (lpString="wecutil.exe") returned 11 [0177.163] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x70a00, Buffer=0x600ae0*, NumberOfBytesToWrite=0x18, NumberOfBytesWritten=0x18e10c | out: Buffer=0x600ae0*, NumberOfBytesWritten=0x18e10c*=0x18) returned 0x0 [0177.163] DbgPrint (Format=0x18e12c, param_2=0x9c0) returned 0x0 [0177.163] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x70c00, Buffer=0x18f468*, NumberOfBytesToWrite=0x5c, NumberOfBytesWritten=0x18e10c | out: Buffer=0x18f468*, NumberOfBytesWritten=0x18e10c*=0x5c) returned 0x0 [0177.163] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18e278, ProcessInformationLength=0x8, ReturnLength=0x18e248 | out: ProcessInformation=0x18e278, ReturnLength=0x18e248) returned 0x0 [0177.163] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18e188, ProcessInformationLength=0x8, ReturnLength=0x18e158 | out: ProcessInformation=0x18e188, ReturnLength=0x18e158) returned 0x0 [0177.163] NtCreateSection (in: SectionHandle=0x18ed28, DesiredAccess=0xa, ObjectAttributes=0x0, MaximumSize=0x18f3b0, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x18ed28*=0x1ec) returned 0x0 [0177.163] NtMapViewOfSection (in: SectionHandle=0x1ec, ProcessHandle=0xffffffffffffffff, BaseAddress=0x18e658*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18e5d8*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18e658*=0x2610000, SectionOffset=0x0, ViewSize=0x18e5d8*=0x16000) returned 0x0 [0177.163] NtMapViewOfSection (in: SectionHandle=0x1ec, ProcessHandle=0x1e4, BaseAddress=0x18f3f8*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18e5f0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f3f8*=0x400000, SectionOffset=0x0, ViewSize=0x18e5f0*=0x16000) returned 0x0 [0177.165] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x2610000) returned 0x0 [0177.166] DbgPrint (Format=0x18e12c, param_2=0xb42) returned 0x0 [0177.166] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7efde008, Buffer=0x18f3f8*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x18edc8 | out: Buffer=0x18f3f8*, NumberOfBytesWritten=0x18edc8*=0x4) returned 0x0 [0177.166] DbgPrint (Format=0x18e12c, param_2=0xb5c) returned 0x0 [0177.166] NtAllocateVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18f400*=0x0, ZeroBits=0x0, RegionSize=0x18ec98*=0x45d9, AllocationType=0x3000, Protect=0x40 | out: BaseAddress=0x18f400*=0x80000, RegionSize=0x18ec98*=0x5000) returned 0x0 [0177.166] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x80000, Buffer=0x66c606*, NumberOfBytesToWrite=0x45d9, NumberOfBytesWritten=0x18edc8 | out: Buffer=0x66c606*, NumberOfBytesWritten=0x18edc8*=0x45d9) returned 0x0 [0177.167] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18f418*=0xdacc45, NumberOfBytesToProtect=0x18eca8, NewAccessProtection=0x40, OldAccessProtection=0x18f578 | out: BaseAddress=0x18f418*=0xdac000, NumberOfBytesToProtect=0x18eca8, OldAccessProtection=0x18f578*=0x20) returned 0x0 [0177.167] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0xdacc45, Buffer=0x18e47f*, NumberOfBytesToWrite=0x1, NumberOfBytesWritten=0x18edc8 | out: Buffer=0x18e47f*, NumberOfBytesWritten=0x18edc8*=0x1) returned 0x0 [0177.167] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0xdacc46, Buffer=0x18e4ac*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x18edc8 | out: Buffer=0x18e4ac*, NumberOfBytesWritten=0x18edc8*=0x4) returned 0x0 [0177.167] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18f418*=0xdacc45, NumberOfBytesToProtect=0x18eca8, NewAccessProtection=0x20, OldAccessProtection=0x18e500 | out: BaseAddress=0x18f418*=0xdac000, NumberOfBytesToProtect=0x18eca8, OldAccessProtection=0x18e500*=0x40) returned 0x0 [0177.167] NtResumeThread (in: ThreadHandle=0x1e0, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0177.167] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0177.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.695] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0177.880] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0177.880] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0177.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.880] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0177.880] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0177.880] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.954] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.973] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0177.973] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0177.974] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0177.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.079] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0178.079] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0178.079] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0178.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.079] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0178.080] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0178.080] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0178.085] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0178.087] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0180.351] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0180.355] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0180.355] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0180.355] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.888] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0180.888] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0180.889] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0180.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.889] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0180.889] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0180.889] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0180.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.987] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.988] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.989] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.990] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.991] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.992] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0180.992] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0180.993] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0180.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0181.117] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0181.117] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0181.118] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0181.118] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0181.123] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0181.125] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0183.359] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0183.362] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0183.362] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0183.363] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0183.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.900] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0183.900] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0183.900] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0183.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.900] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0183.900] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0183.901] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.941] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.942] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.943] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.944] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.992] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.993] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.994] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0183.995] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0183.995] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0183.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.003] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.004] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.005] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.006] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.007] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.008] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.009] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.010] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.011] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.012] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.013] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.014] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.015] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.016] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.017] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.018] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.019] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.020] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.021] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.022] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.023] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.024] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.025] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.026] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.027] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.028] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.029] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.030] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.031] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0184.105] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0184.105] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0184.106] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0184.106] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0184.111] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0184.113] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0186.299] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0186.349] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0186.349] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0186.350] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0186.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.870] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0186.870] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0186.870] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0186.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.870] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0186.870] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0186.871] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.955] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.956] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.957] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.958] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.959] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.960] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.961] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.962] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.963] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0186.964] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0186.964] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.964] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.965] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.966] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.967] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.968] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.969] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.970] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.971] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.972] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.973] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.974] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.975] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.976] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.977] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.978] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.979] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.980] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.981] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.982] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.983] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.984] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.985] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.986] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.995] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.996] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.997] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.998] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0186.999] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.000] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.001] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.002] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0187.078] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0187.078] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0187.079] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0187.079] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0187.084] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0187.086] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0189.801] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0189.805] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0189.805] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0189.805] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.310] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.311] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0190.311] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0190.311] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0190.312] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0190.312] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.312] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.313] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.314] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.315] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.316] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.317] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.318] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.319] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.320] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.321] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.322] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.323] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.324] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.325] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.326] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.327] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.328] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.329] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.330] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.331] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.332] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.333] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.334] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.335] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.336] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.337] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.338] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.339] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.340] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.341] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.342] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.343] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.344] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.345] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.346] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.347] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.348] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.349] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.350] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.351] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.352] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.353] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.354] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.355] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.356] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.356] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.356] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.356] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.356] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.356] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.403] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.404] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0190.405] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0190.405] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.405] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.406] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.407] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.408] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.409] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.410] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.411] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.412] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.413] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.414] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.415] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.416] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.417] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.418] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.419] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.420] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.421] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.422] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.423] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.424] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.425] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.426] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.427] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.428] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.429] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.430] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.431] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.432] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.433] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.434] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.435] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.436] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.437] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.438] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.439] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.440] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.441] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.442] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.443] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.444] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.509] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0190.509] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0190.509] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0190.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.510] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0190.510] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0190.510] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0190.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0190.516] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0190.519] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0192.765] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0192.769] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0192.769] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0192.769] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0193.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.445] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.446] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.447] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0193.447] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0193.447] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0193.447] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.447] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0193.448] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0193.448] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.448] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.449] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.450] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.451] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.452] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.453] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.454] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.455] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.456] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.457] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.458] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.459] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.460] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.461] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.462] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.463] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.464] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.465] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.466] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.467] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.468] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.469] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.470] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.471] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.472] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.473] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.474] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.475] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.476] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.477] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.478] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.479] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.480] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.481] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.482] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.483] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.484] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.485] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.486] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.487] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.488] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.489] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.490] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.491] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.493] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.493] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.493] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.493] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.493] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.493] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.494] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.495] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.496] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.497] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0193.497] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0193.497] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0193.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.497] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.498] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.499] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.500] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.501] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.502] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.503] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.504] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.505] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.506] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.507] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.508] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.509] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.510] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.511] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.512] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.513] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.514] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.515] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.516] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.517] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.518] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.519] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.520] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.521] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.522] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.523] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.524] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.527] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.528] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.529] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.530] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.531] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.532] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.533] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.534] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.535] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.536] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.537] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.538] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.586] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0193.587] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0193.587] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0193.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.587] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0193.587] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0193.587] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0193.593] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0193.595] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0195.019] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0195.024] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0195.024] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0195.024] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.712] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.713] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0202.714] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0202.714] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0202.714] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.714] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0202.714] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0202.714] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.715] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.716] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.717] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.718] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.719] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.720] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.721] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.722] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.723] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.724] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.725] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.726] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.727] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.728] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.729] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.730] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.731] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.732] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.733] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.734] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.735] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.736] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.737] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.738] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.739] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.740] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.741] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.742] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.778] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.778] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.779] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.780] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.781] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.782] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.783] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.784] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.785] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.786] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.787] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.788] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.789] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.790] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.791] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.792] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.793] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.794] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.795] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.796] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.797] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.798] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.799] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.799] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0202.799] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0202.799] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0202.799] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.799] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.799] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.799] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.799] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.799] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.800] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.801] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.802] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.803] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.804] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.805] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.806] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.807] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.808] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.809] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.810] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.811] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.812] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.813] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.814] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.815] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.816] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.817] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.818] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.819] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.820] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.821] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.822] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.823] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.824] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.825] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.826] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.857] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0202.858] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0202.858] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0202.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.858] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0202.858] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0202.858] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0202.863] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0202.866] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0204.015] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0204.019] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0204.019] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0204.019] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0204.525] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.526] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.540] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.553] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.554] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0204.554] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0204.555] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0204.555] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.555] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0204.555] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0204.555] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0204.555] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.555] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.555] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.555] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.556] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.557] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.558] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.559] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.560] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.561] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.562] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.563] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.564] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.565] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.566] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.567] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.568] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.569] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.570] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.571] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.572] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.573] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.574] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.575] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.576] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.577] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.578] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.579] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.580] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.581] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.582] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.583] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.584] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.585] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.586] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.587] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.588] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.589] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.590] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.591] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.592] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.593] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.594] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.595] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.596] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.597] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.598] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.599] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.599] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.636] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.637] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0204.638] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0204.638] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.638] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.639] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.640] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.641] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.642] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.643] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.644] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.645] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.646] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.647] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.648] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.649] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.650] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.651] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.652] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.653] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.654] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.655] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.656] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.657] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.658] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.659] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.660] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.661] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.662] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.663] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.664] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.665] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.666] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.667] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.668] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.669] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.670] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.671] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.672] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.673] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.674] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.675] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.676] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.677] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.677] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.677] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.682] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.683] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.684] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.685] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.686] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.687] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.688] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.689] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.690] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.691] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.692] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.693] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.694] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.695] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.696] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.697] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.698] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.699] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.700] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0204.700] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0204.700] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.701] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0204.701] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0204.701] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.701] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.702] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.703] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.704] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.705] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0204.706] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0204.708] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0205.971] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0205.975] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0205.975] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0205.975] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0207.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.032] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.033] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.034] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.034] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0207.034] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0207.034] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.035] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0207.035] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0207.035] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.035] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.036] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.037] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.038] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.039] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.040] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.041] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.042] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.043] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.044] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.045] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.046] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.047] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.048] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.049] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.050] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.051] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.052] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.053] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.054] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.055] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.056] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.057] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.058] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.059] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.060] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.061] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.062] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.063] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.064] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.065] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.066] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.067] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.068] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.069] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.070] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.071] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.072] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.073] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.074] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.075] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.076] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.077] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.078] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.079] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.080] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.081] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0207.082] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0207.082] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.082] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.083] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.084] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.085] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.086] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.087] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.088] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.089] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.090] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.091] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.092] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.093] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.094] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.095] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.096] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.097] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.098] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.099] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.100] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.101] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.102] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.103] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.104] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.105] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.106] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.107] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.108] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.109] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.110] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.111] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.112] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.113] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.114] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.115] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.116] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.117] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.118] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.119] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.120] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.121] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.122] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.123] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.124] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.125] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.126] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.127] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.128] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.129] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.130] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.131] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.132] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.133] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.134] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.135] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.136] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.137] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.138] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.139] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.140] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.140] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.140] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.140] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.140] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0207.140] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0207.140] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0207.140] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.140] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.140] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.141] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0207.141] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0207.141] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0207.141] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.141] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.141] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.141] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.141] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.141] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.141] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.142] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.143] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.144] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.145] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0207.146] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0207.149] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0208.317] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0208.320] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0208.321] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0208.321] NtDelayExecution (Alertable=0, Interval=0x18e128*=-5000000) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719acd7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ada7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd359, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcfd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd0c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa09a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa02f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dce21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd11b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa066, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd37d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd2d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd13a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.827] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd33d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd321, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb0f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcbe8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181a0d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.828] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0208.828] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcb92, Buffer=0x323cb92*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323cb92*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0208.829] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcb92, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0208.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.829] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0208.829] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcaf5, Buffer=0x323caf5*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x323caf5*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0208.829] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771dcaf5, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771dc000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0208.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a7f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dcc64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.829] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa7a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5af3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd44d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd388, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd3de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf6fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf8cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf88a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf74d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf75f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf7c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf77c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.830] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ac04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719154b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771688e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acf6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f6ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189241, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190c59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b401, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b287, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2220, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b2b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720add4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ec65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191729, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771916f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.831] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719168a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b4c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771891ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a255d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720acc6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719848f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716f843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720dbea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6b7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b777, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771979db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189286, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720b051, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720e157, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a7091, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.832] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771914f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720eb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716267b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771400ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77140134, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ecc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ffdd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170d76, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddd19, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bf1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.833] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718e982, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de107, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b5d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f2d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ddf5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fcf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ec37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cc25, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fd18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd596, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771601cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfbb4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e118, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e49, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6595, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717399a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.834] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c43a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166b95, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193588, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de9cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c132, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192fd2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c8a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718faa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e29c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716da15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77177c5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771def42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cd5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771736dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d04f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.835] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771815f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de0b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188e79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d2f9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f991, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f9a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771711d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1bf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d05cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d004a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5cd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c9fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716cbb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ab61, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720aa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a29ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2859, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.836] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2a3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230003, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77230004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.837] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.838] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.839] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.840] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.841] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.842] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.843] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.844] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.845] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.846] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.847] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.848] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.849] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.850] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.851] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.852] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.853] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.854] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.855] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.856] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.857] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.858] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.859] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194100, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1562, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1215, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e146f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1237, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771956ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179a6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.860] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8293, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a355, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c294, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194c86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194cc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771521f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a01b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2836, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e50e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719db5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e185a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771950a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e16c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.861] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e505d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5133, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4dbd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e53cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77198c1f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f622, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ae93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771937e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a742b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173866, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169f73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772200a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220010, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.862] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f91a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e6b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e68a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf2ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716855f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168626, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d77a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1d90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2324, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718931d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e755f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7662, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.863] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176b2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194f8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7a36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa1d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194a2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d5fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719de3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771892cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de60b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed434, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d36e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717cb4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efb2a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.864] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e67b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771684b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168299, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771effc1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc90d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1807, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f03fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0c35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d228b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717273e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e065, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aec2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3043, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d335a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.865] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172746, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15e6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f15c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2297, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2bc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771692e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ffc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771685cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172d21, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188aff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771887fe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1c72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771986f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.866] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1dfe, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d3a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0dba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170249, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b3b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b2b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bd9b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2745, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719abe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f26ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180c24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d172, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bdee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771683fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.867] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de561, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2fca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0f4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de5d1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2090, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a503, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dffff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a48b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3726, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194ae8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169d35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efded, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efe55, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3053, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.868] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a22a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771936b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195255, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e794d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e66d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771645f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a168, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9e1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2947, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771893d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f159, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cd46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4226, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ddb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210663, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.869] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e51ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ed9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771895a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179d8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c33e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c2c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3380, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771890cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a639, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf030, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716260a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66fb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77187ecd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ef8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718ce41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717163a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a921, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.870] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf56a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175fdf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e61e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771788c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d22da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771784d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5281, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2357, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cef5f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170fcb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717251c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172534, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eda9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.871] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2a56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718939e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d9a2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e66ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e226e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f105, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e7f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1f09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3cff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4247, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.872] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188de8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d598, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ac00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e60e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172642, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172554, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771725b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193b80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f45a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193ecb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ec78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fb37, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.873] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e7e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6c5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed4af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e747b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6f8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717abd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e73d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7176, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6983, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7514, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162718, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172be8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ea63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718941a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2f17, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b141, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f437d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.874] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a851, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168242, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77220080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cecca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771693b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718d460, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e126, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4754, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cde6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bd84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b3b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771efd0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194225, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.875] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719103d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.876] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0208.876] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e1d, Buffer=0x3201e1d*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x3201e1d*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0208.876] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771a1e1d, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771a1000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0208.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162a31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ff5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aa5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.876] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f29c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2ba8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f189d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ebd63, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfaba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b3e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716aaf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d13, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723cf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4c46, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718dbcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf485, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771813ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cdce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.877] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a07, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167dd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168802, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182085, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195ccc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771869fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6096, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9849, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b014, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a03f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a3f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b6d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea6e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2108, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e8b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f97c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb696, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d003f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.878] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a26f5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197c71, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ec5b3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716873a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ee72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f5fe2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa8cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0bd5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e35, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6e59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f546, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f495, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173898, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e54c5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a242f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2449, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e1d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.879] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e78d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718272e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0a4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771826fd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e198, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e208, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167d73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f6ffa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162c42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771647a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.880] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169e6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1728, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ff97, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b5ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f5df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183812, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1a2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a20e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f5a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717939a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b636, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771793cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b669, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0917, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7e4d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771689f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168aad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.881] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6ae9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162740, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162775, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164770, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77164757, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771626f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e726d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed376, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ecf8e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3be5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3c1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bb8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c411, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3f86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c51d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b900, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f38ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.882] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3b06, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d10b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c855, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f3d45, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b9ae, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ba09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc1e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2194, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175734, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a942, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bcb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2b8f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f7973, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f45da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8a72, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a26d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.883] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717241f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771681cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771724af, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f529b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a2120, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717feff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172508, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726ea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172716, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717269a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771726c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717272a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7b85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717f816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152270, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716938f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195d84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.884] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716931b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173dc3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e11a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771865b1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1916, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1412, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1a66, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8f31, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716814c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5fe4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196e11, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196ee3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f984f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77173059, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b6ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a125, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b70f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.885] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f09c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771954f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719f0b5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2b14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a858, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e545, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa0da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef04f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef0cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2a32, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a807e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719fda5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d25ff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182254, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195743, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717eb6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771661ed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.886] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716622c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718938a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e70c7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6fc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f987f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b85b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b06f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2a27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e532e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e0b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172799, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771699a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed5a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.887] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cfa77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183a09, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719781c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d247a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716471c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717bc78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771696ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169953, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a36e5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77196965, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716b988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771723fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de7de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168884, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716882c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d38a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.888] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a348c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3e77, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d3bf9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a4b60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2660, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed94f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf07a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a6edf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771980a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176e68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176ea5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f98c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771701e3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77171f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.889] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771cf099, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f290a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a192, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f2d5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a1f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a0852, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bb43, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718230f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179c1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a901, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718a2d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771629ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771625a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f70b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f097d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e218a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d5ed2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.890] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5f41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e3037, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d850f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77188d1d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d877d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e604f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e619f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771823ad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718aabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1abb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1e4e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167e1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716bfe5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167de3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168456, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e112d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.891] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e10f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1aa1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8261, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0664, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e32ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716e8f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e22e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771694e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717920f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168026, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172cc2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e81ba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1e9a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718090a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.892] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1482, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172ec1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771910d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e4cd6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8a7e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771522ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c74e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172e73, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d377e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4b59, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eb52a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77179fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2aa6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d260f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2637, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a7be, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f4bc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77181bf7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.893] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d6b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e819f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210653, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77180b8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771822f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ed709, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cff2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2f7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2efd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2bff, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2c84, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e2e7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163002, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7f2b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717a0eb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e162b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ad5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178610, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.894] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b0dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170f42, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b524, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f28e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e1164, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771961cb, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771908ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e108f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771838c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190535, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9eb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9b4a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9c4f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9abd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9d02, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.895] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f9cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77194654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174892, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192b6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8dd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8ade, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77166ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6471, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718cb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ba27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e01e7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716692e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.896] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c9bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718f86d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192d08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77182bd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f1b27, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f8fc5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6095, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197093, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197127, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77176d39, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715e819, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b49f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6289, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6581, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6370, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e0397, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.897] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771790bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771df678, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d2325, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8273, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e685b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771401c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ad3d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172c23, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5793, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169292, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ccfd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ef46e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715fc50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719409d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.898] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719500a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ee17a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771f0b5d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a3ac6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7be3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d7bf3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719431a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771de4a3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d1a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e7ec5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e5871, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77193c10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dc027, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718889d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5075, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea2dd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e9d5e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.899] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771680b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192aed, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e90d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183b78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718649d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fa597, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184a3d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e990b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbfe9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184035, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fbb52, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77183fd9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77184ac3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d236d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb2e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcb1e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.900] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fc9d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fcaf2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718be87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d356a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771fafb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eca8a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771eaaad, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168e7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ea148, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d21d9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e6262, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771e623d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77210c9d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716a9ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8b96, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.901] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d8c6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebaf, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77195afc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719853e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771780cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718304e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189f47, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c7f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c5b6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ed41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ef7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77174fcd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fcbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e162, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fba0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fa70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f955, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.902] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d77e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717248d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169ac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff1b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ff05, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185fa2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77175e2f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716951b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f4a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8491, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f216, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dc5b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d54d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a401c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d41c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771774e9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c381, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.903] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719ca24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d8e2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f335, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720f396, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d019, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719cf79, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77185f6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717441c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771805d7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719656e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719b532, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720ebd3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d6d3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c50e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719c985, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719d843, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a92b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.904] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d94a1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daa85, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a638e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719bb14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9f56, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9c7a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9d41, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9e0b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9ac1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a4b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d9a86, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da2c2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da206, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a67c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190cd1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190d36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da088, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da11e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.905] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77190eb5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77189b65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771984ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da915, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771d99d2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a1e98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771daabd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771da6bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a688d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150218, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150230, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150104, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150248, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150260, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150278, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.906] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150290, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714feb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771502f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715032c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715035c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fab0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150378, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150390, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771503f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150408, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.907] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150438, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150450, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150468, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150480, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150498, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771504f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150510, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150528, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150540, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150558, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffc4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715058c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.908] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715016c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771505f0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150608, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150620, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150638, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150650, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150668, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715069c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.909] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771506fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150714, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715072c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150744, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715075c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150774, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715078c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771507ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715081c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.910] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715084c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715087c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fff4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771508f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715090c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150924, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715093c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150954, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150970, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd6c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150988, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.911] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771509ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150a94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150aac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150adc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.912] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ffac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150bf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fde8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.913] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150c88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150cd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ce8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715000c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150d98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150db4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.914] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e5c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150e94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150eac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ec8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ee4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150efc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f890, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150f90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.915] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150fd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150ff0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151008, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151020, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151038, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151050, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151068, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151080, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151098, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.916] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771510f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151110, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151128, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbe0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcf0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151158, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151170, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151188, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715019c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511b8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771511e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151200, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715121c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151234, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.917] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715124c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151264, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150028, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715127c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151298, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa64, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fef8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771512fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151314, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715132c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151344, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715135c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151374, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.918] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715138c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fac8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbf8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771513ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151404, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151420, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715143c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151454, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715146c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151484, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715149c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.919] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771514e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150040, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151500, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151518, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151530, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151548, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151560, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fda0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151590, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.920] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715011c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fdd0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515a8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fa98, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbc8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771515f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715160c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715008c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151624, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715163c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151654, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715166c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.921] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151684, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f950, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516bc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f934, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771516ec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151708, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151720, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151738, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f984, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f96c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151768, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fbb0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151798, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.922] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517d0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771517e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150058, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151804, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715181c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151834, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715184c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151864, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715187c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151894, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771518f8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151928, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151944, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151960, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.923] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715197c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151998, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519b0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f9b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fcb8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771519e4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150154, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fb18, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f99c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.924] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151aa8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ad8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151af4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151b8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ba4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151bec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501e8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c54, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.925] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771501b4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151c8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ca4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cc0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cd8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151cf4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d0c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d28, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d7c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151d94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fca0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150074, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151db0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dcc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151de4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151dfc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.926] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150184, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e14, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e60, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e78, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151e90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ea8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ec0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fc70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ed8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151ef0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f08, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77150138, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fae0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f8ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f24, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f3c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f58, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.927] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715213c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fd4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152004, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715201c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152034, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fbc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151f8c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fec, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715204c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77151fa4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152064, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715207c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152094, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520ac, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520dc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152124, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771520f4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.928] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715210c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714f918, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fafc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771500d4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714fe04, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7714ff2c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab704, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044fc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772044b2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8d00, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abc40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77172760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.929] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abd80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77163140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168990, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204533, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b140, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f880, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77170a90, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168860, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716ad68, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77234328, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe40, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204586, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207a6f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204691, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c36, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2c6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.930] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772078df, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a54a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772046c9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720455a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207910, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204646, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207acd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abe80, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204750, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204760, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e16, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162417, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f10, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772049f7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.931] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207f6e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7716c7b9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a48, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718c27c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720816c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772081e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204a75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22fa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207aa9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719dda7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a22db, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720793e, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204672, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207af9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a74b7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9d88, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.932] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207d7d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ef93, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77207e74, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b4c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169337, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204b6b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715f63b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204bba, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204c38, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f34, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f53, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720822f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720834a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aaa8d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204f8b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a8706, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abee0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.933] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d2f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717d300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715ebdc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.934] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0208.934] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abfa0, Buffer=0x320bfa0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320bfa0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0208.934] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771abfa0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ab000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0208.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fc7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.934] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.934] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x40, OldAccessProtection=0x18e034 | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e034*=0x20) returned 0x0 [0208.935] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac0e0, Buffer=0x320c0e0*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x18e104 | out: Buffer=0x320c0e0*, NumberOfBytesWritten=0x18e104*=0x5) returned 0x0 [0208.935] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e06c*=0x771ac0e0, NumberOfBytesToProtect=0x18dfd4, NewAccessProtection=0x20, OldAccessProtection=0x18e02c | out: BaseAddress=0x18e06c*=0x771ac000, NumberOfBytesToProtect=0x18dfd4, OldAccessProtection=0x18e02c*=0x40) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204418, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77197966, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720448d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c3d5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204466, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043a9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720443f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043f3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772043ce, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.935] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204384, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd44, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718bd15, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77191121, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050a5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050d8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772050bd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717c79b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77204fb2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab7c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771aa152, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac240, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77162265, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77152340, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208578, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77168f50, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772085f6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7715df20, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.936] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ab8a0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205191, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abac0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772053c3, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086ab, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771abb94, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054a7, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772086cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac310, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719596f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77169c70, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac400, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac300, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771959cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac490, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac4e0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac570, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208715, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192f65, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.937] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a5c30, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eaa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac6c0, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac700, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac730, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac780, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772087f2, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717ca3a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772054ee, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720550d, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719290f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772088da, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771ac810, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720559f, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77178bf5, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055cc, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772055ef, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd470, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.938] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771dd496, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720567b, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77208659, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77192930, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7720569a, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771789aa, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f1c, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771624c4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056cd, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771686a6, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x771a9eea, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772056f1, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205710, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717e478, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167f75, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205755, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7719e4de, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057a4, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.939] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7718b617, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77167ee9, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x772057c8, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77160c87, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x7717b4ca, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205835, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.940] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x77205816, Buffer=0x18e110, NumberOfBytesToRead=0x1, NumberOfBytesRead=0x18e0b4 | out: Buffer=0x18e110*, NumberOfBytesRead=0x18e0b4*=0x1) returned 0x0 [0208.940] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0208.942] NtWriteVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x76f51000, Buffer=0x3311000*, NumberOfBytesToWrite=0x10027a, NumberOfBytesWritten=0x0 | out: Buffer=0x3311000*, NumberOfBytesWritten=0x0) returned 0x0 [0210.116] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x76f51000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0210.120] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x40, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x20) returned 0x0 [0210.120] NtProtectVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, NewAccessProtection=0x20, OldAccessProtection=0x18e0f4 | out: BaseAddress=0x18e124*=0x74661000, NumberOfBytesToProtect=0x18e0c4, OldAccessProtection=0x18e0f4*=0x40) returned 0x0 [0210.120] NtDelayExecution (Alertable=0, Interval=0x18e128*=-10000000) returned 0x0 [0211.541] NtReadVirtualMemory (in: ProcessHandle=0x1e4, BaseAddress=0x80000, Buffer=0x18e378, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x18e37c | out: Buffer=0x18e378*, NumberOfBytesRead=0x18e37c*=0x4) returned 0x0 [0211.541] NtDelayExecution (Alertable=0, Interval=0x18e128*=-10000000) returned 0x0 [0212.555] NtTerminateProcess (ProcessHandle=0xffffffff, ExitStatus=0x0) Thread: id = 2 os_tid = 0x988 Thread: id = 3 os_tid = 0xa08 Thread: id = 4 os_tid = 0xa0c Process: id = "2" image_name = "nslookup.exe" filename = "c:\\windows\\syswow64\\nslookup.exe" page_root = "0x61f12000" os_pid = "0x3b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x978" cmd_line = "\"C:\\Windows\\system32\\nslookup.exe\"" cur_dir = "C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x90 [0192.617] LoadLibraryW (lpLibFileName="ole32") returned 0x755e0000 [0192.620] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0192.621] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0192.621] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\wecutil.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\wecutil.exe")) returned 0xffffffff [0192.621] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wecutil.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\wecutil.lnk")) returned 0xffffffff [0192.621] CoInitialize (pvReserved=0x0) returned 0x0 [0192.673] CoCreateInstance (in: rclsid=0x1efa58*(Data1=0x4991d34b, Data2=0x80a1, Data3=0x4291, Data4=([0]=0x83, [1]=0xb6, [2]=0x33, [3]=0x28, [4]=0x36, [5]=0x6b, [6]=0x90, [7]=0x97)), pUnkOuter=0x0, dwClsContext=0x4, riid=0x1efa68*(Data1=0x5ce34c0d, Data2=0xdc9, Data3=0x4c1f, Data4=([0]=0x89, [1]=0x7c, [2]=0xda, [3]=0xa1, [4]=0xb7, [5]=0x8c, [6]=0xee, [7]=0x7c)), ppv=0x1efa80 | out: ppv=0x1efa80*=0x56a6a4) returned 0x0 [0195.027] IBackgroundCopyManager:CreateJob (in: This=0x56a6a4, DisplayName="wecutil.exe", Type=0x0, pJobId=0x1efa48, ppJob=0x1efa88 | out: pJobId=0x1efa48*(Data1=0xa1c6092a, Data2=0x16c0, Data3=0x42bd, Data4=([0]=0x9e, [1]=0x36, [2]=0x61, [3]=0x19, [4]=0x7b, [5]=0x49, [6]=0x46, [7]=0xff)), ppJob=0x1efa88*=0x56a77c) returned 0x0 [0202.333] IBackgroundCopyJob:AddFile (This=0x56a77c, RemoteUrl="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\greencrypt_crypt.exe", LocalName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\wecutil.exe") returned 0x0 [0202.350] IBackgroundCopyJob:Resume (This=0x56a77c) returned 0x0 [0202.367] IBackgroundCopyJob:GetProgress (in: This=0x56a77c, pVal=0x1efa30 | out: pVal=0x1efa30) returned 0x0 [0202.388] IBackgroundCopyJob:GetProgress (in: This=0x56a77c, pVal=0x1efa30 | out: pVal=0x1efa30) returned 0x0 [0202.389] NtDelayExecution (Alertable=0, Interval=0x1efa18*=-10000000) returned 0x0 [0203.402] IBackgroundCopyJob:GetProgress (in: This=0x56a77c, pVal=0x1efa30 | out: pVal=0x1efa30) returned 0x0 [0203.492] NtDelayExecution (Alertable=0, Interval=0x1efa18*=-10000000) returned 0x0 [0204.505] IBackgroundCopyJob:Complete (This=0x56a77c) returned 0x0 [0204.513] IUnknown:Release (This=0x56a77c) returned 0x0 [0204.514] CoInitialize (pvReserved=0x0) returned 0x1 [0204.514] CoCreateInstance (in: rclsid=0x1efa68*(Data1=0x21401, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x1efa78*(Data1=0x214f9, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1efa90 | out: ppv=0x1efa90*=0x57a4f8) returned 0x0 [0204.520] ShellLink:IShellLinkW:SetPath (This=0x57a4f8, pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\wecutil.exe") returned 0x0 [0206.683] ShellLink:IUnknown:QueryInterface (in: This=0x57a4f8, riid=0x1efa58*(Data1=0x10b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1efa88 | out: ppvObject=0x1efa88*=0x57a504) returned 0x0 [0206.684] ShellLink:IPersistFile:Save (This=0x57a504, pszFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bfc8f96.lnk", fRemember=1) returned 0x0 [0206.715] ShellLink:IUnknown:Release (This=0x57a504) returned 0x1 [0206.715] ShellLink:IUnknown:Release (This=0x57a4f8) returned 0x0 [0206.715] CoInitialize (pvReserved=0x0) returned 0x1 [0206.715] CoCreateInstance (in: rclsid=0x1efa58*(Data1=0x4991d34b, Data2=0x80a1, Data3=0x4291, Data4=([0]=0x83, [1]=0xb6, [2]=0x33, [3]=0x28, [4]=0x36, [5]=0x6b, [6]=0x90, [7]=0x97)), pUnkOuter=0x0, dwClsContext=0x4, riid=0x1efa68*(Data1=0x5ce34c0d, Data2=0xdc9, Data3=0x4c1f, Data4=([0]=0x89, [1]=0x7c, [2]=0xda, [3]=0xa1, [4]=0xb7, [5]=0x8c, [6]=0xee, [7]=0x7c)), ppv=0x1efa80 | out: ppv=0x1efa80*=0x56a6a4) returned 0x0 [0206.718] IBackgroundCopyManager:CreateJob (in: This=0x56a6a4, DisplayName="wecutil.exe", Type=0x0, pJobId=0x1efa48, ppJob=0x1efa88 | out: pJobId=0x1efa48*(Data1=0x126d49b3, Data2=0xe6ab, Data3=0x4edf, Data4=([0]=0x96, [1]=0x2e, [2]=0xaa, [3]=0x68, [4]=0x4d, [5]=0xff, [6]=0xce, [7]=0x26)), ppJob=0x1efa88*=0x5ba90c) returned 0x0 [0206.723] IBackgroundCopyJob:AddFile (This=0x5ba90c, RemoteUrl="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bfc8f96.lnk", LocalName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wecutil.lnk") returned 0x0 [0206.737] IBackgroundCopyJob:Resume (This=0x5ba90c) returned 0x0 [0206.744] IBackgroundCopyJob:GetProgress (in: This=0x5ba90c, pVal=0x1efa30 | out: pVal=0x1efa30) returned 0x0 [0206.753] IBackgroundCopyJob:GetProgress (in: This=0x5ba90c, pVal=0x1efa30 | out: pVal=0x1efa30) returned 0x0 [0206.754] NtDelayExecution (Alertable=0, Interval=0x1efa18*=-10000000) returned 0x0 [0207.770] IBackgroundCopyJob:GetProgress (in: This=0x5ba90c, pVal=0x1efa30 | out: pVal=0x1efa30) returned 0x0 [0207.906] NtDelayExecution (Alertable=0, Interval=0x1efa18*=-10000000) returned 0x0 [0208.920] IBackgroundCopyJob:Complete (This=0x5ba90c) returned 0x0 [0209.108] IUnknown:Release (This=0x5ba90c) returned 0x0 [0209.201] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bfc8f96.lnk" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bfc8f96.lnk")) returned 0x2020 [0209.201] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\wecutil.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\wecutil.exe")) returned 0x20 [0209.201] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wecutil.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\wecutil.lnk")) returned 0x2020 [0209.201] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\wecutil.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\wecutil.exe")) returned 0x20 [0209.202] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wecutil.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\wecutil.lnk")) returned 0x2020 [0209.202] NtDelayExecution (Alertable=0, Interval=0x1efa90*=-1000000) returned 0x0 [0209.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efb20 | out: lpSystemTimeAsFileTime=0x1efb20*(dwLowDateTime=0x314c5380, dwHighDateTime=0x1d52864)) [0209.357] GetCurrentProcessId () returned 0x3b0 [0209.357] GetCurrentThreadId () returned 0x90 [0209.357] GetTickCount () returned 0x41276 [0209.357] QueryPerformanceCounter (in: lpPerformanceCount=0x1efb18 | out: lpPerformanceCount=0x1efb18*=32947241678) returned 1 [0209.357] GetStartupInfoW (in: lpStartupInfo=0x1efac4 | out: lpStartupInfo=0x1efac4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\nslookup.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x1efb28, hStdError=0x408ca4)) [0209.357] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0209.357] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x290000 [0209.358] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0209.358] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0209.358] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0209.358] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0209.358] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0209.359] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x214) returned 0x2907d0 [0209.359] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0209.359] GetCurrentThreadId () returned 0x90 [0209.359] GetStartupInfoW (in: lpStartupInfo=0x1efa60 | out: lpStartupInfo=0x1efa60*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\nslookup.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40726a, hStdOutput=0x4075a3, hStdError=0x2907d0)) [0209.359] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x800) returned 0x2909f0 [0209.360] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0209.360] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0209.360] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0209.360] SetHandleCount (uNumber=0x20) returned 0x20 [0209.360] GetCommandLineA () returned="\"C:\\Windows\\system32\\nslookup.exe\"" [0209.360] GetEnvironmentStringsW () returned 0x5bfc30* [0209.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0209.360] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x565) returned 0x2911f8 [0209.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2911f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0209.360] FreeEnvironmentStringsW (penv=0x5bfc30) returned 1 [0209.360] GetLastError () returned 0x36b7 [0209.360] SetLastError (dwErrCode=0x36b7) [0209.360] GetLastError () returned 0x36b7 [0209.360] SetLastError (dwErrCode=0x36b7) [0209.360] GetLastError () returned 0x36b7 [0209.360] SetLastError (dwErrCode=0x36b7) [0209.360] GetACP () returned 0x4e4 [0209.360] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x220) returned 0x291768 [0209.360] GetLastError () returned 0x36b7 [0209.360] SetLastError (dwErrCode=0x36b7) [0209.360] IsValidCodePage (CodePage=0x4e4) returned 1 [0209.360] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1efa28 | out: lpCPInfo=0x1efa28) returned 1 [0209.360] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1ef4f4 | out: lpCPInfo=0x1ef4f4) returned 1 [0209.361] GetLastError () returned 0x36b7 [0209.361] SetLastError (dwErrCode=0x36b7) [0209.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1ef908, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0209.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1ef908, cbMultiByte=256, lpWideCharStr=0x1ef278, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0209.361] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x1ef508 | out: lpCharType=0x1ef508) returned 1 [0209.361] GetLastError () returned 0x36b7 [0209.361] SetLastError (dwErrCode=0x36b7) [0209.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1ef908, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0209.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1ef908, cbMultiByte=256, lpWideCharStr=0x1ef238, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0209.361] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0209.361] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x1ef028, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0209.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x1ef808, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xf7\x3a\x5e\x9a\x40\xfa\x1e", lpUsedDefaultChar=0x0) returned 256 [0209.361] GetLastError () returned 0x36b7 [0209.361] SetLastError (dwErrCode=0x36b7) [0209.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1ef908, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0209.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1ef908, cbMultiByte=256, lpWideCharStr=0x1ef258, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0209.361] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0209.361] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x1ef048, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0209.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x1ef708, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xf7\x3a\x5e\x9a\x40\xfa\x1e", lpUsedDefaultChar=0x0) returned 256 [0209.361] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x40f728, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe")) returned 0x20 [0209.361] GetLastError () returned 0x0 [0209.361] SetLastError (dwErrCode=0x0) [0209.361] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.362] GetLastError () returned 0x0 [0209.362] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.363] SetLastError (dwErrCode=0x0) [0209.363] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x29) returned 0x291990 [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.364] SetLastError (dwErrCode=0x0) [0209.364] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.365] GetLastError () returned 0x0 [0209.365] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.366] SetLastError (dwErrCode=0x0) [0209.366] GetLastError () returned 0x0 [0209.367] SetLastError (dwErrCode=0x0) [0209.367] GetLastError () returned 0x0 [0209.367] SetLastError (dwErrCode=0x0) [0209.367] GetLastError () returned 0x0 [0209.367] SetLastError (dwErrCode=0x0) [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x98) returned 0x2919c8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1f) returned 0x291a68 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x36) returned 0x291a90 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x37) returned 0x291ad0 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3c) returned 0x291b10 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x31) returned 0x291b58 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x17) returned 0x291b98 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x24) returned 0x291bb8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x14) returned 0x291be8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xd) returned 0x291c08 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x25) returned 0x291c20 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x39) returned 0x291c50 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x18) returned 0x291c98 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x17) returned 0x291cb8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe) returned 0x291cd8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x69) returned 0x291cf0 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3e) returned 0x291d68 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1b) returned 0x291db0 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1d) returned 0x291dd8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x48) returned 0x291e00 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x12) returned 0x291e50 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x18) returned 0x291e70 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1b) returned 0x291e90 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x24) returned 0x291eb8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x29) returned 0x291ee8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291f20 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x41) returned 0x291f48 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x17) returned 0x291f98 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xf) returned 0x291fb8 [0209.367] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x16) returned 0x291fd0 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2a) returned 0x291ff0 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x29) returned 0x292028 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x15) returned 0x292060 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x292080 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2a) returned 0x2920a8 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x12) returned 0x2920e0 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x18) returned 0x292100 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x46) returned 0x292120 [0209.368] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2911f8 | out: hHeap=0x290000) returned 1 [0209.368] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0209.368] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x80) returned 0x2911f8 [0209.368] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4081f6) returned 0x0 [0209.369] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2911f8) returned 0x80 [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.369] SetLastError (dwErrCode=0x0) [0209.369] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.370] GetLastError () returned 0x0 [0209.370] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.371] GetLastError () returned 0x0 [0209.371] SetLastError (dwErrCode=0x0) [0209.372] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x30) returned 0x291280 [0209.372] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x30a0) returned 0x292170 [0209.372] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x174) returned 0x2912b8 [0209.372] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x291438 [0209.372] CryptAcquireContextW (in: phProv=0x40fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x40fcf0*=0x5a37b8) returned 1 [0209.373] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef964, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef9cc | out: phKey=0x1ef9cc*=0x5a2af0) returned 1 [0209.376] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef9b4, dwFlags=0x0) returned 1 [0209.376] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291438, pdwDataLen=0x1ef980 | out: pbData=0x291438, pdwDataLen=0x1ef980) returned 1 [0209.377] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.377] GetTickCount () returned 0x41286 [0209.378] GetLastError () returned 0x0 [0209.378] SetLastError (dwErrCode=0x0) [0209.378] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x1ef9f0, cchData=32 | out: lpLCData="\x03") returned 16 [0209.378] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1c) returned 0x291450 [0209.378] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1c) returned 0x291478 [0209.378] GetVersion () returned 0x1db10106 [0209.378] GetCurrentProcess () returned 0xffffffff [0209.378] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1ef9d8 | out: TokenHandle=0x1ef9d8*=0x260) returned 1 [0209.378] GetTokenInformation (in: TokenHandle=0x260, TokenInformationClass=0x14, TokenInformation=0x1ef9d0, TokenInformationLength=0x4, ReturnLength=0x1ef9d4 | out: TokenInformation=0x1ef9d0, ReturnLength=0x1ef9d4) returned 1 [0209.378] CloseHandle (hObject=0x260) returned 1 [0209.378] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0209.378] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef934 | out: phKey=0x1ef934*=0x5a2af0) returned 1 [0209.379] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef91c, dwFlags=0x0) returned 1 [0209.379] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef8e8 | out: pbData=0x2914a0, pdwDataLen=0x1ef8e8) returned 1 [0209.379] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.379] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0209.379] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0209.379] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0209.379] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef90c | out: phKey=0x1ef90c*=0x5a2af0) returned 1 [0209.379] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8f4, dwFlags=0x0) returned 1 [0209.379] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x1ef8c0 | out: pbData=0x291518, pdwDataLen=0x1ef8c0) returned 1 [0209.379] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.379] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0209.379] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0209.379] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0209.379] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0209.379] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ef974, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ef974*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0209.379] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0209.379] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0209.379] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef968 | out: phKey=0x1ef968*=0x5a2af0) returned 1 [0209.379] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef950, dwFlags=0x0) returned 1 [0209.379] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef91c | out: pbData=0x2914a0, pdwDataLen=0x1ef91c) returned 1 [0209.379] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.379] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0209.379] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0209.379] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x260 [0209.379] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0x0) returned 0x0 [0209.380] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0209.380] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0209.380] ReleaseMutex (hMutex=0x260) returned 1 [0209.380] CloseHandle (hObject=0x260) returned 1 [0209.380] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0209.380] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef948 | out: phKey=0x1ef948*=0x5a2af0) returned 1 [0209.380] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef930, dwFlags=0x0) returned 1 [0209.380] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef8fc | out: pbData=0x2914a0, pdwDataLen=0x1ef8fc) returned 1 [0209.380] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.380] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0209.380] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0209.380] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0209.380] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8b8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef920 | out: phKey=0x1ef920*=0x5a2af0) returned 1 [0209.380] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef908, dwFlags=0x0) returned 1 [0209.380] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x1ef8d4 | out: pbData=0x291518, pdwDataLen=0x1ef8d4) returned 1 [0209.380] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.380] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0209.380] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0209.380] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0209.380] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0209.380] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ef988, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ef988*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0209.380] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0209.380] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0209.380] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef914, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef97c | out: phKey=0x1ef97c*=0x5a2af0) returned 1 [0209.380] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef964, dwFlags=0x0) returned 1 [0209.380] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef930 | out: pbData=0x2914a0, pdwDataLen=0x1ef930) returned 1 [0209.380] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.380] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0209.380] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4201") returned 0x0 [0209.381] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4201") returned 0x260 [0209.381] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0x0) returned 0x0 [0209.381] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0209.381] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0209.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402019, lpParameter=0x1efa50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0209.381] Sleep (dwMilliseconds=0x1388) [0214.801] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0214.802] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef934 | out: phKey=0x1ef934*=0x5a2af0) returned 1 [0214.802] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef91c, dwFlags=0x0) returned 1 [0214.802] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef8e8 | out: pbData=0x2914a0, pdwDataLen=0x1ef8e8) returned 1 [0214.802] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0214.802] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0214.802] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0214.802] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef90c | out: phKey=0x1ef90c*=0x5a2af0) returned 1 [0214.802] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8f4, dwFlags=0x0) returned 1 [0214.802] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x1ef8c0 | out: pbData=0x291518, pdwDataLen=0x1ef8c0) returned 1 [0214.802] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.802] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0214.802] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0214.802] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0214.802] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0214.802] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ef974, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ef974*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0214.802] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0214.802] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef968 | out: phKey=0x1ef968*=0x5a2af0) returned 1 [0214.802] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef950, dwFlags=0x0) returned 1 [0214.802] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef91c | out: pbData=0x2914a0, pdwDataLen=0x1ef91c) returned 1 [0214.802] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0214.802] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0214.802] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x270 [0214.803] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x0 [0214.803] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0214.803] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0214.803] ReleaseMutex (hMutex=0x270) returned 1 [0214.803] CloseHandle (hObject=0x270) returned 1 [0214.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x60) returned 0x2914a0 [0214.803] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef924, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef98c | out: phKey=0x1ef98c*=0x5a2af0) returned 1 [0214.803] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef974, dwFlags=0x0) returned 1 [0214.803] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef940 | out: pbData=0x2914a0, pdwDataLen=0x1ef940) returned 1 [0214.803] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291508 [0214.803] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef964 | out: phKey=0x1ef964*=0x5a2af0) returned 1 [0214.803] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef94c, dwFlags=0x0) returned 1 [0214.803] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x1ef918 | out: pbData=0x291508, pdwDataLen=0x1ef918) returned 1 [0214.803] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291530 [0214.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x291558 [0214.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291580 [0214.803] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef93c | out: phKey=0x1ef93c*=0x5a2af0) returned 1 [0214.803] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef924, dwFlags=0x0) returned 1 [0214.803] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291580, pdwDataLen=0x1ef8f0 | out: pbData=0x291580, pdwDataLen=0x1ef8f0) returned 1 [0214.803] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.803] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291580 | out: hHeap=0x290000) returned 1 [0214.803] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x291530, nSize=0xf | out: lpDst="") returned 0x2c [0214.803] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291558 | out: hHeap=0x290000) returned 1 [0214.803] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291530, Size=0x3a) returned 0x291530 [0214.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x3a) returned 0x291578 [0214.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x2915c0 [0214.803] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef938 | out: phKey=0x1ef938*=0x5a2af0) returned 1 [0214.803] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef920, dwFlags=0x0) returned 1 [0214.803] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2915c0, pdwDataLen=0x1ef8ec | out: pbData=0x2915c0, pdwDataLen=0x1ef8ec) returned 1 [0214.803] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.804] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2915c0 | out: hHeap=0x290000) returned 1 [0214.804] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x291530, nSize=0x1d | out: lpDst="") returned 0x2c [0214.804] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291578 | out: hHeap=0x290000) returned 1 [0214.804] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291530, Size=0x72) returned 0x291530 [0214.804] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x72) returned 0x2915b0 [0214.804] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291630 [0214.804] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef938 | out: phKey=0x1ef938*=0x5a2af0) returned 1 [0214.804] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef920, dwFlags=0x0) returned 1 [0214.804] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291630, pdwDataLen=0x1ef8ec | out: pbData=0x291630, pdwDataLen=0x1ef8ec) returned 1 [0214.804] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.804] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291630 | out: hHeap=0x290000) returned 1 [0214.804] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x291530, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0214.804] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2915b0 | out: hHeap=0x290000) returned 1 [0214.804] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.804] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2915b0 [0214.804] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef960 | out: phKey=0x1ef960*=0x5a2af0) returned 1 [0214.804] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef948, dwFlags=0x0) returned 1 [0214.804] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2915b0, pdwDataLen=0x1ef914 | out: pbData=0x2915b0, pdwDataLen=0x1ef914) returned 1 [0214.804] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.804] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3e) returned 0x2915f8 [0214.804] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x3e) returned 0x291640 [0214.804] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291688 [0214.804] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef938 | out: phKey=0x1ef938*=0x5a2af0) returned 1 [0214.804] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef920, dwFlags=0x0) returned 1 [0214.804] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291688, pdwDataLen=0x1ef8ec | out: pbData=0x291688, pdwDataLen=0x1ef8ec) returned 1 [0214.804] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.804] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x10) returned 0x291508 [0214.804] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ef8b4 | out: phkResult=0x1ef8b4*=0x270) returned 0x0 [0214.804] RegQueryValueExW (in: hKey=0x270, lpValueName="Startup", lpReserved=0x0, lpType=0x1ef8b0, lpData=0x291640, lpcbData=0x1ef8b8*=0x3e | out: lpType=0x1ef8b0*=0x2, lpData=0x291640*=0x18, lpcbData=0x1ef8b8*=0x98) returned 0xea [0214.804] RegCloseKey (hKey=0x270) returned 0x0 [0214.804] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.804] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291688 | out: hHeap=0x290000) returned 1 [0214.805] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291640 | out: hHeap=0x290000) returned 1 [0214.805] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2915f8, Size=0x7a) returned 0x2915f8 [0214.805] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x7a) returned 0x291680 [0214.805] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295218 [0214.805] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef934 | out: phKey=0x1ef934*=0x5a2af0) returned 1 [0214.805] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef91c, dwFlags=0x0) returned 1 [0214.805] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295218, pdwDataLen=0x1ef8e8 | out: pbData=0x295218, pdwDataLen=0x1ef8e8) returned 1 [0214.805] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.805] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x10) returned 0x291508 [0214.805] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ef8b0 | out: phkResult=0x1ef8b0*=0x270) returned 0x0 [0214.805] RegQueryValueExW (in: hKey=0x270, lpValueName="Startup", lpReserved=0x0, lpType=0x1ef8ac, lpData=0x291680, lpcbData=0x1ef8b4*=0x7a | out: lpType=0x1ef8ac*=0x2, lpData=0x291680*=0x18, lpcbData=0x1ef8b4*=0x98) returned 0xea [0214.805] RegCloseKey (hKey=0x270) returned 0x0 [0214.805] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.805] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0214.805] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291680 | out: hHeap=0x290000) returned 1 [0214.805] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2915f8, Size=0xf2) returned 0x2915f8 [0214.805] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xf2) returned 0x295218 [0214.805] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295318 [0214.805] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef934 | out: phKey=0x1ef934*=0x5a2af0) returned 1 [0214.805] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef91c, dwFlags=0x0) returned 1 [0214.805] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295318, pdwDataLen=0x1ef8e8 | out: pbData=0x295318, pdwDataLen=0x1ef8e8) returned 1 [0214.805] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.805] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x10) returned 0x291508 [0214.805] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ef8b0 | out: phkResult=0x1ef8b0*=0x270) returned 0x0 [0214.805] RegQueryValueExW (in: hKey=0x270, lpValueName="Startup", lpReserved=0x0, lpType=0x1ef8ac, lpData=0x295218, lpcbData=0x1ef8b4*=0xf2 | out: lpType=0x1ef8ac*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1ef8b4*=0x98) returned 0x0 [0214.805] RegCloseKey (hKey=0x270) returned 0x0 [0214.805] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.805] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291508 [0214.806] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ef8b0 | out: phkResult=0x1ef8b0*=0x270) returned 0x0 [0214.806] RegQueryValueExW (in: hKey=0x270, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1ef8ac, lpData=0x2952b0, lpcbData=0x1ef8b4*=0x5a | out: lpType=0x1ef8ac*=0x0, lpData=0x2952b0*=0xc4, lpcbData=0x1ef8b4*=0x5a) returned 0x2 [0214.806] RegCloseKey (hKey=0x270) returned 0x0 [0214.806] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ef8c4 | out: phkResult=0x1ef8c4*=0x270) returned 0x0 [0214.806] RegQueryValueExW (in: hKey=0x270, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1ef8c0, lpData=0x2952b0, lpcbData=0x1ef8c8*=0x5a | out: lpType=0x1ef8c0*=0x2, lpData=0x2952b0*=0xc4, lpcbData=0x1ef8c8*=0x78) returned 0xea [0214.806] RegCloseKey (hKey=0x270) returned 0x0 [0214.806] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.806] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295318 | out: hHeap=0x290000) returned 1 [0214.806] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0214.806] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2915f8, Size=0x1e2) returned 0x295218 [0214.806] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e2) returned 0x295408 [0214.806] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x2915f8 [0214.806] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef934 | out: phKey=0x1ef934*=0x5a2af0) returned 1 [0214.806] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef91c, dwFlags=0x0) returned 1 [0214.806] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2915f8, pdwDataLen=0x1ef8e8 | out: pbData=0x2915f8, pdwDataLen=0x1ef8e8) returned 1 [0214.806] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.806] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x10) returned 0x291508 [0214.806] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ef8b0 | out: phkResult=0x1ef8b0*=0x270) returned 0x0 [0214.806] RegQueryValueExW (in: hKey=0x270, lpValueName="Startup", lpReserved=0x0, lpType=0x1ef8ac, lpData=0x295408, lpcbData=0x1ef8b4*=0x1e2 | out: lpType=0x1ef8ac*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1ef8b4*=0x98) returned 0x0 [0214.806] RegCloseKey (hKey=0x270) returned 0x0 [0214.806] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.806] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291508 [0214.806] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ef8b0 | out: phkResult=0x1ef8b0*=0x270) returned 0x0 [0214.807] RegQueryValueExW (in: hKey=0x270, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1ef8ac, lpData=0x2954a0, lpcbData=0x1ef8b4*=0x14a | out: lpType=0x1ef8ac*=0x0, lpData=0x2954a0*=0x0, lpcbData=0x1ef8b4*=0x14a) returned 0x2 [0214.807] RegCloseKey (hKey=0x270) returned 0x0 [0214.807] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ef8c4 | out: phkResult=0x1ef8c4*=0x270) returned 0x0 [0214.807] RegQueryValueExW (in: hKey=0x270, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1ef8c0, lpData=0x2954a0, lpcbData=0x1ef8c8*=0x14a | out: lpType=0x1ef8c0*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1ef8c8*=0x78) returned 0x0 [0214.807] RegCloseKey (hKey=0x270) returned 0x0 [0214.807] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.807] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2915f8 | out: hHeap=0x290000) returned 1 [0214.807] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x295218, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0214.807] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295408 | out: hHeap=0x290000) returned 1 [0214.807] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2915b0 | out: hHeap=0x290000) returned 1 [0214.807] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x295408 [0214.807] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x295620 [0214.807] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x295838 [0214.807] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x295a50 [0214.807] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x295408, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe")) returned 0x20 [0214.807] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x295c68 [0214.807] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x295c68, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe")) returned 0x20 [0214.807] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295c68 | out: hHeap=0x290000) returned 1 [0214.807] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x295c68 [0214.807] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x295c68, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe")) returned 0x20 [0214.807] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295c68 | out: hHeap=0x290000) returned 1 [0214.807] CopyFileW (lpExistingFileName="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\nslookup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\nslookup.exe"), bFailIfExists=0) returned 1 [0214.815] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1ef9c8 | out: phkResult=0x1ef9c8*=0x280) returned 0x0 [0214.816] RegSetValueExW (in: hKey=0x280, lpValueName="nslookup", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\nslookup.exe", cbData=0x70 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\nslookup.exe") returned 0x0 [0214.816] RegCloseKey (hKey=0x280) returned 0x0 [0214.816] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1ef9b4 | out: phkResult=0x1ef9b4*=0x280) returned 0x0 [0214.816] RegSetValueExW (in: hKey=0x280, lpValueName="nslookup", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\nslookup.exe", cbData=0x70 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\nslookup.exe") returned 0x0 [0214.817] RegCloseKey (hKey=0x280) returned 0x0 [0214.817] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x134) returned 0x2915b0 [0214.817] GetLastError () returned 0x0 [0214.817] SetLastError (dwErrCode=0x0) [0214.817] GetLastError () returned 0x0 [0214.817] SetLastError (dwErrCode=0x0) [0214.817] GetLastError () returned 0x0 [0214.817] SetLastError (dwErrCode=0x0) [0214.817] GetLastError () returned 0x0 [0214.817] SetLastError (dwErrCode=0x0) [0214.817] GetLastError () returned 0x0 [0214.817] SetLastError (dwErrCode=0x0) [0214.817] GetLastError () returned 0x0 [0214.817] SetLastError (dwErrCode=0x0) [0214.817] GetLastError () returned 0x0 [0214.817] SetLastError (dwErrCode=0x0) [0214.817] GetLastError () returned 0x0 [0214.817] SetLastError (dwErrCode=0x0) [0214.817] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.818] GetLastError () returned 0x0 [0214.818] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.819] SetLastError (dwErrCode=0x0) [0214.819] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.820] GetLastError () returned 0x0 [0214.820] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.821] SetLastError (dwErrCode=0x0) [0214.821] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.822] SetLastError (dwErrCode=0x0) [0214.822] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.823] SetLastError (dwErrCode=0x0) [0214.823] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.824] GetLastError () returned 0x0 [0214.824] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.825] SetLastError (dwErrCode=0x0) [0214.825] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.826] GetLastError () returned 0x0 [0214.826] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.827] GetLastError () returned 0x0 [0214.827] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] SetLastError (dwErrCode=0x0) [0214.828] GetLastError () returned 0x0 [0214.828] CopyFileW (lpExistingFileName="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\nslookup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\nslookup.exe"), bFailIfExists=1) returned 1 [0214.833] CopyFileW (lpExistingFileName="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\nslookup.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\nslookup.exe"), bFailIfExists=1) returned 1 [0214.836] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2915b0 | out: hHeap=0x290000) returned 1 [0214.836] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295408 | out: hHeap=0x290000) returned 1 [0214.836] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295620 | out: hHeap=0x290000) returned 1 [0214.836] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295838 | out: hHeap=0x290000) returned 1 [0214.837] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295a50 | out: hHeap=0x290000) returned 1 [0214.837] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0214.837] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291530 | out: hHeap=0x290000) returned 1 [0214.837] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0214.837] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xc0) returned 0x2914a0 [0214.837] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef958, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef9c0 | out: phKey=0x1ef9c0*=0x5a2af0) returned 1 [0214.837] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef9a8, dwFlags=0x0) returned 1 [0214.837] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef974 | out: pbData=0x2914a0, pdwDataLen=0x1ef974) returned 1 [0214.837] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.837] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xbd) returned 0x291568 [0214.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4030e4, lpParameter=0x291568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0214.838] WaitForSingleObject (hHandle=0x280, dwMilliseconds=0x0) returned 0x102 [0214.838] CloseHandle (hObject=0x280) returned 1 [0214.838] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0214.838] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x60) returned 0x2914a0 [0214.838] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef964, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef9cc | out: phKey=0x1ef9cc*=0x5a2af0) returned 1 [0214.838] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef9b4, dwFlags=0x0) returned 1 [0214.838] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef980 | out: pbData=0x2914a0, pdwDataLen=0x1ef980) returned 1 [0214.838] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.838] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x5c) returned 0x291630 [0214.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4030e4, lpParameter=0x291630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0214.839] WaitForSingleObject (hHandle=0x280, dwMilliseconds=0x1388) returned 0x102 [0223.121] CloseHandle (hObject=0x280) returned 1 [0223.121] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0223.121] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0223.121] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef92c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef994 | out: phKey=0x1ef994*=0x5a2af0) returned 1 [0223.121] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef97c, dwFlags=0x0) returned 1 [0223.121] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x1ef948 | out: pbData=0x2914a0, pdwDataLen=0x1ef948) returned 1 [0223.121] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.121] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0223.121] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0223.121] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295218 [0223.121] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef904, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef96c | out: phKey=0x1ef96c*=0x5a2af0) returned 1 [0223.121] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef954, dwFlags=0x0) returned 1 [0223.121] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295218, pdwDataLen=0x1ef920 | out: pbData=0x295218, pdwDataLen=0x1ef920) returned 1 [0223.121] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.121] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0223.121] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0223.121] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0223.121] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0223.121] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ef9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ef9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.121] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0223.121] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x2914a0 [0223.121] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x291748 [0223.121] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef910, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef978 | out: phKey=0x1ef978*=0x5a2af0) returned 1 [0223.121] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef960, dwFlags=0x0) returned 1 [0223.121] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291748, pdwDataLen=0x1ef92c | out: pbData=0x291748, pdwDataLen=0x1ef92c) returned 1 [0223.121] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.121] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x80) returned 0x2914d0 [0223.122] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef908, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef970 | out: phKey=0x1ef970*=0x5a2af0) returned 1 [0223.122] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef958, dwFlags=0x0) returned 1 [0223.122] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914d0, pdwDataLen=0x1ef924 | out: pbData=0x2914d0, pdwDataLen=0x1ef924) returned 1 [0223.122] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x74) returned 0x295218 [0223.122] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x295218, Size=0xe6) returned 0x295218 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x295308 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xb40) returned 0x295320 [0223.122] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef940 | out: phKey=0x1ef940*=0x5a2af0) returned 1 [0223.122] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef928, dwFlags=0x0) returned 1 [0223.122] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295320, pdwDataLen=0x1ef8f4 | out: pbData=0x295320, pdwDataLen=0x1ef8f4) returned 1 [0223.122] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x230) returned 0x295e68 [0223.122] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef938 | out: phKey=0x1ef938*=0x5a2af0) returned 1 [0223.122] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef920, dwFlags=0x0) returned 1 [0223.122] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295e68, pdwDataLen=0x1ef8ec | out: pbData=0x295e68, pdwDataLen=0x1ef8ec) returned 1 [0223.122] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x2960a0 [0223.122] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef910 | out: phKey=0x1ef910*=0x5a2af0) returned 1 [0223.122] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8f8, dwFlags=0x0) returned 1 [0223.122] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2960a0, pdwDataLen=0x1ef8c4 | out: pbData=0x2960a0, pdwDataLen=0x1ef8c4) returned 1 [0223.122] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x84) returned 0x296138 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x84) returned 0x2961c8 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x296258 [0223.122] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef880, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef8e8 | out: phKey=0x1ef8e8*=0x5a2af0) returned 1 [0223.122] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8d0, dwFlags=0x0) returned 1 [0223.122] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296258, pdwDataLen=0x1ef89c | out: pbData=0x296258, pdwDataLen=0x1ef89c) returned 1 [0223.122] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.122] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296258 | out: hHeap=0x290000) returned 1 [0223.122] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x296138, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0223.122] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2961c8 | out: hHeap=0x290000) returned 1 [0223.122] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x290000) returned 1 [0223.122] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2960a0 [0223.122] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef90c | out: phKey=0x1ef90c*=0x5a2af0) returned 1 [0223.122] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8f4, dwFlags=0x0) returned 1 [0223.122] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2960a0, pdwDataLen=0x1ef8c0 | out: pbData=0x2960a0, pdwDataLen=0x1ef8c0) returned 1 [0223.122] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.123] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x18) returned 0x2960c8 [0223.123] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x18) returned 0x2960e8 [0223.123] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x2961c8 [0223.123] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef87c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef8e4 | out: phKey=0x1ef8e4*=0x5a2af0) returned 1 [0223.123] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8cc, dwFlags=0x0) returned 1 [0223.123] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961c8, pdwDataLen=0x1ef898 | out: pbData=0x2961c8, pdwDataLen=0x1ef898) returned 1 [0223.123] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.123] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2961c8 | out: hHeap=0x290000) returned 1 [0223.123] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x2960c8, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0223.123] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2960e8 | out: hHeap=0x290000) returned 1 [0223.123] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x290000) returned 1 [0223.123] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x2961c8 [0223.123] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x2963e0 [0223.123] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2963e0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe")) returned 0x20 [0223.123] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2963e0 | out: hHeap=0x290000) returned 1 [0223.123] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xb38) returned 0x2963e0 [0223.123] GetLastError () returned 0x0 [0223.123] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2963e0, Size=0xd64) returned 0x296f20 [0223.123] GetLastError () returned 0x0 [0223.123] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x86) returned 0x297c90 [0223.123] GetLastError () returned 0x0 [0223.123] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x297c90, Size=0xa0) returned 0x297c90 [0223.123] GetLastError () returned 0x0 [0223.124] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1a) returned 0x2960a0 [0223.124] GetLastError () returned 0x0 [0223.124] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef92c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef994 | out: phKey=0x1ef994*=0x5a2af0) returned 1 [0223.124] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef97c, dwFlags=0x0) returned 1 [0223.124] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914d0, pdwDataLen=0x1ef948 | out: pbData=0x2914d0, pdwDataLen=0x1ef948) returned 1 [0223.124] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.124] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914f8 [0223.124] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x291520 [0223.124] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x297d38 [0223.124] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef904, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef96c | out: phKey=0x1ef96c*=0x5a2af0) returned 1 [0223.124] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef954, dwFlags=0x0) returned 1 [0223.124] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297d38, pdwDataLen=0x1ef920 | out: pbData=0x297d38, pdwDataLen=0x1ef920) returned 1 [0223.124] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.124] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297d38 | out: hHeap=0x290000) returned 1 [0223.124] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0223.124] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291520 | out: hHeap=0x290000) returned 1 [0223.124] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914d0 | out: hHeap=0x290000) returned 1 [0223.124] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ef9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ef9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.124] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f8 | out: hHeap=0x290000) returned 1 [0223.124] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x2914d0 [0223.124] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x291748 [0223.124] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef910, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef978 | out: phKey=0x1ef978*=0x5a2af0) returned 1 [0223.124] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef960, dwFlags=0x0) returned 1 [0223.124] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291748, pdwDataLen=0x1ef92c | out: pbData=0x291748, pdwDataLen=0x1ef92c) returned 1 [0223.124] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.124] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x80) returned 0x297d38 [0223.124] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef908, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef970 | out: phKey=0x1ef970*=0x5a2af0) returned 1 [0223.124] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef958, dwFlags=0x0) returned 1 [0223.124] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297d38, pdwDataLen=0x1ef924 | out: pbData=0x297d38, pdwDataLen=0x1ef924) returned 1 [0223.124] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x74) returned 0x297dc0 [0223.125] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x297dc0, Size=0xe6) returned 0x297dc0 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x291500 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xb40) returned 0x295320 [0223.125] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef940 | out: phKey=0x1ef940*=0x5a2af0) returned 1 [0223.125] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef928, dwFlags=0x0) returned 1 [0223.125] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295320, pdwDataLen=0x1ef8f4 | out: pbData=0x295320, pdwDataLen=0x1ef8f4) returned 1 [0223.125] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x230) returned 0x295e68 [0223.125] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef938 | out: phKey=0x1ef938*=0x5a2af0) returned 1 [0223.125] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef920, dwFlags=0x0) returned 1 [0223.125] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295e68, pdwDataLen=0x1ef8ec | out: pbData=0x295e68, pdwDataLen=0x1ef8ec) returned 1 [0223.125] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x297eb0 [0223.125] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef910 | out: phKey=0x1ef910*=0x5a2af0) returned 1 [0223.125] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8f8, dwFlags=0x0) returned 1 [0223.125] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297eb0, pdwDataLen=0x1ef8c4 | out: pbData=0x297eb0, pdwDataLen=0x1ef8c4) returned 1 [0223.125] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x84) returned 0x297f48 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x84) returned 0x2960c8 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x296158 [0223.125] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef880, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef8e8 | out: phKey=0x1ef8e8*=0x5a2af0) returned 1 [0223.125] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8d0, dwFlags=0x0) returned 1 [0223.125] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296158, pdwDataLen=0x1ef89c | out: pbData=0x296158, pdwDataLen=0x1ef89c) returned 1 [0223.125] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.125] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296158 | out: hHeap=0x290000) returned 1 [0223.125] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x297f48, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0223.125] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2960c8 | out: hHeap=0x290000) returned 1 [0223.125] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297eb0 | out: hHeap=0x290000) returned 1 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291518 [0223.125] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef8a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef90c | out: phKey=0x1ef90c*=0x5a2af0) returned 1 [0223.125] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8f4, dwFlags=0x0) returned 1 [0223.125] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x1ef8c0 | out: pbData=0x291518, pdwDataLen=0x1ef8c0) returned 1 [0223.125] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x18) returned 0x291540 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x18) returned 0x297eb0 [0223.125] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x2960c8 [0223.126] CryptImportKey (in: hProv=0x5a37b8, pbData=0x1ef87c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1ef8e4 | out: phKey=0x1ef8e4*=0x5a2af0) returned 1 [0223.126] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x1ef8cc, dwFlags=0x0) returned 1 [0223.126] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2960c8, pdwDataLen=0x1ef898 | out: pbData=0x2960c8, pdwDataLen=0x1ef898) returned 1 [0223.126] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.126] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2960c8 | out: hHeap=0x290000) returned 1 [0223.126] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x291540, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0223.126] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297eb0 | out: hHeap=0x290000) returned 1 [0223.126] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0223.126] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x2960c8 [0223.126] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x2962e0 [0223.126] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2962e0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe")) returned 0x20 [0223.126] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2962e0 | out: hHeap=0x290000) returned 1 [0223.126] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xb38) returned 0x2962e0 [0223.126] GetLastError () returned 0x0 [0223.126] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x297eb0, Size=0xa0) returned 0x296e20 [0223.126] GetLastError () returned 0x0 [0223.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401f96, lpParameter=0x1efa6c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0223.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401e5c, lpParameter=0x1efa5c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4 [0223.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401932, lpParameter=0x1efa6c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0223.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401a5d, lpParameter=0x1efa6c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0223.129] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0x810 Thread: id = 7 os_tid = 0x80c Thread: id = 8 os_tid = 0x640 Thread: id = 9 os_tid = 0x648 Thread: id = 48 os_tid = 0x88c Thread: id = 49 os_tid = 0x854 [0209.421] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0209.421] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0209.421] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0209.421] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fbf8 | out: pbData=0x2914a0, pdwDataLen=0x293fbf8) returned 1 [0209.421] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.421] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0209.421] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0209.421] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0209.421] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0209.421] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0209.421] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x293fbd0 | out: pbData=0x291518, pdwDataLen=0x293fbd0) returned 1 [0209.421] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0209.421] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0209.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0209.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0209.421] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0209.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0209.422] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0209.422] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0209.422] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0209.422] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fc2c | out: pbData=0x2914a0, pdwDataLen=0x293fc2c) returned 1 [0209.422] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.422] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0209.422] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0209.422] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x26c [0209.422] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x0 [0209.422] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0209.422] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0209.422] ReleaseMutex (hMutex=0x26c) returned 1 [0209.422] CloseHandle (hObject=0x26c) returned 1 [0209.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401ffe, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0209.423] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0209.423] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0209.423] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0209.423] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fbf8 | out: pbData=0x2914a0, pdwDataLen=0x293fbf8) returned 1 [0209.423] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.423] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0209.423] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0209.423] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0209.423] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0209.423] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0209.423] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x293fbd0 | out: pbData=0x291518, pdwDataLen=0x293fbd0) returned 1 [0209.423] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.423] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0209.423] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0209.423] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0209.423] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0209.423] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0209.423] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0209.423] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0209.423] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0209.424] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0209.424] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fc2c | out: pbData=0x2914a0, pdwDataLen=0x293fc2c) returned 1 [0209.424] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.424] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0209.424] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0209.424] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x270 [0209.424] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x0 [0209.424] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0209.424] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0209.424] ReleaseMutex (hMutex=0x270) returned 1 [0209.424] CloseHandle (hObject=0x270) returned 1 [0209.424] Sleep (dwMilliseconds=0x3e8) [0210.609] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0210.609] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0210.609] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0210.609] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fbf8 | out: pbData=0x2914a0, pdwDataLen=0x293fbf8) returned 1 [0210.609] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0210.609] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0210.609] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0210.609] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0210.609] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0210.609] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0210.609] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x293fbd0 | out: pbData=0x291518, pdwDataLen=0x293fbd0) returned 1 [0210.609] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0210.609] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0210.609] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0210.609] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0210.609] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0210.609] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0210.609] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0210.609] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0210.609] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0210.609] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0210.609] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fc2c | out: pbData=0x2914a0, pdwDataLen=0x293fc2c) returned 1 [0210.609] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0210.609] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0210.609] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0210.610] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x270 [0210.610] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x0 [0210.610] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0210.610] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0210.610] ReleaseMutex (hMutex=0x270) returned 1 [0210.610] CloseHandle (hObject=0x270) returned 1 [0210.610] Sleep (dwMilliseconds=0x3e8) [0211.993] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0211.993] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0211.993] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0211.993] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fbf8 | out: pbData=0x2914a0, pdwDataLen=0x293fbf8) returned 1 [0211.994] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0211.994] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0211.994] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0211.994] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0211.994] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0211.994] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0211.994] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x293fbd0 | out: pbData=0x291518, pdwDataLen=0x293fbd0) returned 1 [0211.994] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0211.994] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0211.994] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0211.994] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0211.994] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0211.994] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0211.994] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0211.994] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0211.994] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0211.994] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0211.994] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fc2c | out: pbData=0x2914a0, pdwDataLen=0x293fc2c) returned 1 [0211.994] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0211.994] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0211.994] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0211.994] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x270 [0211.994] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x0 [0211.994] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0211.994] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0211.995] ReleaseMutex (hMutex=0x270) returned 1 [0211.995] CloseHandle (hObject=0x270) returned 1 [0211.995] Sleep (dwMilliseconds=0x3e8) [0213.007] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0213.007] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0213.007] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0213.007] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fbf8 | out: pbData=0x2914a0, pdwDataLen=0x293fbf8) returned 1 [0213.007] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0213.007] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0213.007] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0213.007] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0213.008] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0213.008] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0213.008] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x293fbd0 | out: pbData=0x291518, pdwDataLen=0x293fbd0) returned 1 [0213.008] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0213.008] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0213.008] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0213.008] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0213.008] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0213.008] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0213.008] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0213.008] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0213.008] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0213.008] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0213.008] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fc2c | out: pbData=0x2914a0, pdwDataLen=0x293fc2c) returned 1 [0213.008] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0213.008] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0213.008] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0213.008] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x270 [0213.008] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x0 [0213.008] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0213.008] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0213.008] ReleaseMutex (hMutex=0x270) returned 1 [0213.008] CloseHandle (hObject=0x270) returned 1 [0213.009] Sleep (dwMilliseconds=0x3e8) [0214.021] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x2914a0 [0214.021] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0214.021] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0214.021] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fbf8 | out: pbData=0x2914a0, pdwDataLen=0x293fbf8) returned 1 [0214.021] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.021] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2914c8 [0214.021] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x2914f0 [0214.021] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x291518 [0214.021] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0214.022] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0214.022] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291518, pdwDataLen=0x293fbd0 | out: pbData=0x291518, pdwDataLen=0x293fbd0) returned 1 [0214.022] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.022] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291518 | out: hHeap=0x290000) returned 1 [0214.022] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2914c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0214.022] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914f0 | out: hHeap=0x290000) returned 1 [0214.022] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0214.022] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0214.022] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914c8 | out: hHeap=0x290000) returned 1 [0214.022] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x2914a0 [0214.022] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0214.022] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0214.022] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2914a0, pdwDataLen=0x293fc2c | out: pbData=0x2914a0, pdwDataLen=0x293fc2c) returned 1 [0214.022] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.022] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x2914e8 [0214.022] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0214.022] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x270 [0214.022] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x0 [0214.022] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 [0214.022] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914e8 | out: hHeap=0x290000) returned 1 [0214.022] ReleaseMutex (hMutex=0x270) returned 1 [0214.022] CloseHandle (hObject=0x270) returned 1 [0214.022] Sleep (dwMilliseconds=0x3e8) [0215.248] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291508 [0215.248] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0215.248] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0215.248] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x293fbf8 | out: pbData=0x291508, pdwDataLen=0x293fbf8) returned 1 [0215.248] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0215.248] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291530 [0215.248] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x295218 [0215.248] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295240 [0215.248] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0215.248] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0215.248] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295240, pdwDataLen=0x293fbd0 | out: pbData=0x295240, pdwDataLen=0x293fbd0) returned 1 [0215.248] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0215.248] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295240 | out: hHeap=0x290000) returned 1 [0215.249] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x291530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0215.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0215.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0215.249] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0215.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291530 | out: hHeap=0x290000) returned 1 [0215.249] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x291508 [0215.249] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0215.249] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0215.249] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x293fc2c | out: pbData=0x291508, pdwDataLen=0x293fc2c) returned 1 [0215.249] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0215.249] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x295218 [0215.249] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0215.249] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x2b4 [0215.249] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x0 [0215.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0215.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0215.249] ReleaseMutex (hMutex=0x2b4) returned 1 [0215.249] CloseHandle (hObject=0x2b4) returned 1 [0215.249] Sleep (dwMilliseconds=0x3e8) [0218.360] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291508 [0218.361] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0218.361] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0218.361] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x293fbf8 | out: pbData=0x291508, pdwDataLen=0x293fbf8) returned 1 [0218.361] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0218.361] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291530 [0218.361] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x295218 [0218.361] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295240 [0218.361] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0218.361] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0218.361] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295240, pdwDataLen=0x293fbd0 | out: pbData=0x295240, pdwDataLen=0x293fbd0) returned 1 [0218.361] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0218.361] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295240 | out: hHeap=0x290000) returned 1 [0218.361] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x291530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0218.361] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0218.361] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0218.361] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0218.362] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291530 | out: hHeap=0x290000) returned 1 [0218.362] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x291508 [0218.362] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0218.362] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0218.362] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x293fc2c | out: pbData=0x291508, pdwDataLen=0x293fc2c) returned 1 [0218.362] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0218.362] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x295218 [0218.362] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0218.362] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x2b4 [0218.362] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x0 [0218.362] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0218.362] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0218.362] ReleaseMutex (hMutex=0x2b4) returned 1 [0218.362] CloseHandle (hObject=0x2b4) returned 1 [0218.362] Sleep (dwMilliseconds=0x3e8) [0220.557] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291508 [0220.560] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0220.562] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0220.563] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x293fbf8 | out: pbData=0x291508, pdwDataLen=0x293fbf8) returned 1 [0220.563] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0220.563] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291530 [0220.563] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x295218 [0220.563] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295240 [0220.563] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0220.563] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0220.563] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295240, pdwDataLen=0x293fbd0 | out: pbData=0x295240, pdwDataLen=0x293fbd0) returned 1 [0220.563] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0220.563] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295240 | out: hHeap=0x290000) returned 1 [0220.563] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x291530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0220.563] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0220.563] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0220.566] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0220.566] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291530 | out: hHeap=0x290000) returned 1 [0220.566] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x291508 [0220.566] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0220.566] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0220.566] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x293fc2c | out: pbData=0x291508, pdwDataLen=0x293fc2c) returned 1 [0220.566] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0220.566] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x295218 [0220.566] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0220.566] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x2b4 [0220.567] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x0 [0220.567] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0220.567] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0220.567] ReleaseMutex (hMutex=0x2b4) returned 1 [0220.567] CloseHandle (hObject=0x2b4) returned 1 [0220.567] Sleep (dwMilliseconds=0x3e8) [0223.119] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291508 [0223.119] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2af0) returned 1 [0223.119] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0223.119] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x293fbf8 | out: pbData=0x291508, pdwDataLen=0x293fbf8) returned 1 [0223.119] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.119] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291530 [0223.119] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x295218 [0223.119] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295240 [0223.119] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2af0) returned 1 [0223.120] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0223.120] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295240, pdwDataLen=0x293fbd0 | out: pbData=0x295240, pdwDataLen=0x293fbd0) returned 1 [0223.120] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.120] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295240 | out: hHeap=0x290000) returned 1 [0223.120] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x291530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0223.120] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0223.120] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0223.120] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.120] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291530 | out: hHeap=0x290000) returned 1 [0223.120] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x291508 [0223.120] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2af0) returned 1 [0223.120] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0223.120] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x293fc2c | out: pbData=0x291508, pdwDataLen=0x293fc2c) returned 1 [0223.120] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.120] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x295218 [0223.120] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0223.120] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x2b4 [0223.120] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x0 [0223.120] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0223.120] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0223.120] ReleaseMutex (hMutex=0x2b4) returned 1 [0223.120] CloseHandle (hObject=0x2b4) returned 1 [0223.120] Sleep (dwMilliseconds=0x3e8) [0224.489] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce70 [0224.489] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2f30) returned 1 [0224.489] CryptSetKeyParam (hKey=0x5a2f30, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0224.489] CryptDecrypt (in: hKey=0x5a2f30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce70, pdwDataLen=0x293fbf8 | out: pbData=0x29ce70, pdwDataLen=0x293fbf8) returned 1 [0224.489] CryptDestroyKey (hKey=0x5a2f30) returned 1 [0224.489] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce98 [0224.489] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0224.489] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0224.489] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2f30) returned 1 [0224.489] CryptSetKeyParam (hKey=0x5a2f30, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0224.489] CryptDecrypt (in: hKey=0x5a2f30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0224.489] CryptDestroyKey (hKey=0x5a2f30) returned 1 [0224.489] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0224.489] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0224.489] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0224.489] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0224.489] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0224.489] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0224.489] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0224.489] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2f30) returned 1 [0224.489] CryptSetKeyParam (hKey=0x5a2f30, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0224.489] CryptDecrypt (in: hKey=0x5a2f30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0224.489] CryptDestroyKey (hKey=0x5a2f30) returned 1 [0224.489] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0224.489] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0224.490] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x338 [0224.490] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x0 [0224.490] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0224.490] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0224.490] ReleaseMutex (hMutex=0x338) returned 1 [0224.490] CloseHandle (hObject=0x338) returned 1 [0224.490] Sleep (dwMilliseconds=0x3e8) [0226.286] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce98 [0226.286] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2d70) returned 1 [0226.286] CryptSetKeyParam (hKey=0x5a2d70, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0226.286] CryptDecrypt (in: hKey=0x5a2d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce98, pdwDataLen=0x293fbf8 | out: pbData=0x29ce98, pdwDataLen=0x293fbf8) returned 1 [0226.286] CryptDestroyKey (hKey=0x5a2d70) returned 1 [0226.286] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce70 [0226.286] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0226.286] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0226.286] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2d70) returned 1 [0226.286] CryptSetKeyParam (hKey=0x5a2d70, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0226.286] CryptDecrypt (in: hKey=0x5a2d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0226.286] CryptDestroyKey (hKey=0x5a2d70) returned 1 [0226.286] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0226.286] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0226.286] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0226.286] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0226.286] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0226.286] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0226.286] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0226.286] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2d70) returned 1 [0226.286] CryptSetKeyParam (hKey=0x5a2d70, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0226.286] CryptDecrypt (in: hKey=0x5a2d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0226.286] CryptDestroyKey (hKey=0x5a2d70) returned 1 [0226.286] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0226.286] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0226.287] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x338 [0226.287] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x0 [0226.287] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0226.287] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0226.287] ReleaseMutex (hMutex=0x338) returned 1 [0226.287] CloseHandle (hObject=0x338) returned 1 [0226.287] Sleep (dwMilliseconds=0x3e8) [0227.596] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce70 [0227.599] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2d30) returned 1 [0227.599] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0227.599] CryptDecrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce70, pdwDataLen=0x293fbf8 | out: pbData=0x29ce70, pdwDataLen=0x293fbf8) returned 1 [0227.599] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.599] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce98 [0227.607] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0227.607] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0227.607] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2d30) returned 1 [0227.607] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0227.614] CryptDecrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0227.616] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.616] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0227.616] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0227.620] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0227.620] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0227.620] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0227.621] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0227.621] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0227.621] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2db0) returned 1 [0227.621] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0227.621] CryptDecrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0227.621] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.621] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0227.621] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0227.621] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x344 [0227.621] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x0 [0227.621] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0227.621] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0227.621] ReleaseMutex (hMutex=0x344) returned 1 [0227.621] CloseHandle (hObject=0x344) returned 1 [0227.621] Sleep (dwMilliseconds=0x3e8) [0229.747] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce98 [0229.747] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2fb0) returned 1 [0229.747] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0229.747] CryptDecrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce98, pdwDataLen=0x293fbf8 | out: pbData=0x29ce98, pdwDataLen=0x293fbf8) returned 1 [0229.747] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.747] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce70 [0229.747] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0229.747] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0229.747] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2fb0) returned 1 [0229.747] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0229.747] CryptDecrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0229.747] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.747] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0229.747] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0229.747] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0229.747] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0229.747] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0229.747] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0229.747] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0229.747] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2fb0) returned 1 [0229.748] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0229.748] CryptDecrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0229.748] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.748] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0229.748] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0229.748] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x398 [0229.748] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x0 [0229.748] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0229.748] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0229.748] ReleaseMutex (hMutex=0x398) returned 1 [0229.748] CloseHandle (hObject=0x398) returned 1 [0229.748] Sleep (dwMilliseconds=0x3e8) [0231.105] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce70 [0231.105] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2e70) returned 1 [0231.105] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0231.105] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce70, pdwDataLen=0x293fbf8 | out: pbData=0x29ce70, pdwDataLen=0x293fbf8) returned 1 [0231.105] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.105] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce98 [0231.105] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0231.105] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0231.105] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2e70) returned 1 [0231.105] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0231.106] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0231.106] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.106] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0231.106] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0231.106] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0231.111] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0231.111] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0231.135] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0231.135] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0231.135] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2e70) returned 1 [0231.135] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0231.135] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0231.135] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.135] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0231.135] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0231.135] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x388 [0231.135] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x0 [0231.135] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0231.135] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0231.135] ReleaseMutex (hMutex=0x388) returned 1 [0231.135] CloseHandle (hObject=0x388) returned 1 [0231.135] Sleep (dwMilliseconds=0x3e8) [0233.525] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce98 [0233.525] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2cb0) returned 1 [0233.525] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0233.525] CryptDecrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce98, pdwDataLen=0x293fbf8 | out: pbData=0x29ce98, pdwDataLen=0x293fbf8) returned 1 [0233.526] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.526] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce70 [0233.526] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0233.526] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0233.526] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2cb0) returned 1 [0233.526] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0233.526] CryptDecrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0233.526] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.526] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0233.526] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0233.526] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0233.526] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0233.526] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0233.526] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0233.526] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0233.526] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2cb0) returned 1 [0233.526] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0233.526] CryptDecrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0233.526] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.526] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0233.526] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0233.526] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x370 [0233.526] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x0 [0233.527] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0233.527] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0233.527] ReleaseMutex (hMutex=0x370) returned 1 [0233.527] CloseHandle (hObject=0x370) returned 1 [0233.527] Sleep (dwMilliseconds=0x3e8) [0234.720] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce70 [0234.721] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2e70) returned 1 [0234.721] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0234.721] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce70, pdwDataLen=0x293fbf8 | out: pbData=0x29ce70, pdwDataLen=0x293fbf8) returned 1 [0234.721] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0234.721] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce98 [0234.721] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0234.721] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0234.721] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2e70) returned 1 [0234.721] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0234.721] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0234.721] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0234.721] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0234.721] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0234.721] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0234.721] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0234.721] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0234.721] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0234.721] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0234.721] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2e70) returned 1 [0234.721] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0234.721] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0234.721] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0234.721] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0234.721] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0234.721] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x374 [0234.722] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x0) returned 0x0 [0234.722] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0234.722] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0234.722] ReleaseMutex (hMutex=0x374) returned 1 [0234.722] CloseHandle (hObject=0x374) returned 1 [0234.722] Sleep (dwMilliseconds=0x3e8) [0236.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce98 [0236.015] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2e70) returned 1 [0236.015] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0236.015] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce98, pdwDataLen=0x293fbf8 | out: pbData=0x29ce98, pdwDataLen=0x293fbf8) returned 1 [0236.015] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0236.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce70 [0236.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0236.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0236.015] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2e70) returned 1 [0236.015] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0236.015] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0236.015] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0236.015] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0236.015] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0236.015] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0236.015] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0236.015] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0236.016] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0236.016] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0236.016] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2e70) returned 1 [0236.016] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0236.016] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0236.016] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0236.016] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0236.016] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0236.016] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x388 [0236.016] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x0 [0236.016] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0236.016] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0236.016] ReleaseMutex (hMutex=0x388) returned 1 [0236.016] CloseHandle (hObject=0x388) returned 1 [0236.016] Sleep (dwMilliseconds=0x3e8) [0237.627] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce70 [0237.627] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2eb0) returned 1 [0237.627] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0237.627] CryptDecrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce70, pdwDataLen=0x293fbf8 | out: pbData=0x29ce70, pdwDataLen=0x293fbf8) returned 1 [0237.627] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0237.627] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce98 [0237.627] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0237.627] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0237.627] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2eb0) returned 1 [0237.627] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0237.627] CryptDecrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0237.627] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0237.627] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0237.628] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0237.628] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0237.628] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0237.628] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0237.628] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0237.628] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0237.628] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2eb0) returned 1 [0237.628] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0237.628] CryptDecrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0237.628] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0237.628] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0237.629] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0237.629] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x380 [0237.629] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0x0) returned 0x0 [0237.629] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0237.629] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0237.629] ReleaseMutex (hMutex=0x380) returned 1 [0237.629] CloseHandle (hObject=0x380) returned 1 [0237.629] Sleep (dwMilliseconds=0x3e8) [0239.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce98 [0239.015] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2ef0) returned 1 [0239.015] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0239.015] CryptDecrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce98, pdwDataLen=0x293fbf8 | out: pbData=0x29ce98, pdwDataLen=0x293fbf8) returned 1 [0239.015] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce70 [0239.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0239.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0239.015] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2ef0) returned 1 [0239.015] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0239.015] CryptDecrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0239.015] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.015] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0239.015] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0239.015] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0239.015] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0239.015] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0239.015] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0239.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0239.015] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2ef0) returned 1 [0239.015] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0239.015] CryptDecrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0239.015] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.015] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0239.015] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0239.016] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x398 [0239.016] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x0 [0239.016] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0239.016] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0239.016] ReleaseMutex (hMutex=0x398) returned 1 [0239.016] CloseHandle (hObject=0x398) returned 1 [0239.016] Sleep (dwMilliseconds=0x3e8) [0240.755] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce70 [0240.755] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2e70) returned 1 [0240.756] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0240.756] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce70, pdwDataLen=0x293fbf8 | out: pbData=0x29ce70, pdwDataLen=0x293fbf8) returned 1 [0240.756] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0240.756] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce98 [0240.756] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0240.756] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0240.756] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2e70) returned 1 [0240.756] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0240.756] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0240.756] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0240.756] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0240.756] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0240.756] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0240.756] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0240.756] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0240.756] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0240.756] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0240.756] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2e70) returned 1 [0240.756] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0240.756] CryptDecrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0240.756] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0240.756] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0240.756] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0240.757] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x388 [0240.757] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x0 [0240.757] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0240.757] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0240.757] ReleaseMutex (hMutex=0x388) returned 1 [0240.757] CloseHandle (hObject=0x388) returned 1 [0240.757] Sleep (dwMilliseconds=0x3e8) [0242.048] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x29ce98 [0242.048] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc44 | out: phKey=0x293fc44*=0x5a2eb0) returned 1 [0242.048] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x293fc2c, dwFlags=0x0) returned 1 [0242.048] CryptDecrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29ce98, pdwDataLen=0x293fbf8 | out: pbData=0x29ce98, pdwDataLen=0x293fbf8) returned 1 [0242.048] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.048] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce70 [0242.048] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29cec0 [0242.048] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x29de98 [0242.048] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc1c | out: phKey=0x293fc1c*=0x5a2eb0) returned 1 [0242.048] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x293fc04, dwFlags=0x0) returned 1 [0242.048] CryptDecrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x293fbd0 | out: pbData=0x29de98, pdwDataLen=0x293fbd0) returned 1 [0242.048] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.048] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0242.048] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0242.048] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29cec0 | out: hHeap=0x290000) returned 1 [0242.048] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0242.048] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x293fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x293fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0242.048] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0242.049] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297f90 [0242.049] CryptImportKey (in: hProv=0x5a37b8, pbData=0x293fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x293fc78 | out: phKey=0x293fc78*=0x5a2eb0) returned 1 [0242.049] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x293fc60, dwFlags=0x0) returned 1 [0242.049] CryptDecrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f90, pdwDataLen=0x293fc2c | out: pbData=0x297f90, pdwDataLen=0x293fc2c) returned 1 [0242.049] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.049] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x34) returned 0x29de98 [0242.049] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22229C354B4200") returned 0x0 [0242.049] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22229C354B4200") returned 0x39c [0242.049] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0x0) returned 0x0 [0242.049] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0242.049] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0242.049] ReleaseMutex (hMutex=0x39c) returned 1 [0242.049] CloseHandle (hObject=0x39c) returned 1 [0242.049] Sleep (dwMilliseconds=0x3e8) Thread: id = 50 os_tid = 0x894 [0209.466] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20a) returned 0x2914a0 [0209.466] GetVersion () returned 0x1db10106 [0209.466] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x50) returned 0x2916b8 [0209.466] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d2f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d2f9d0 | out: phKey=0x2d2f9d0*=0x5a2af0) returned 1 [0209.466] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2d2f9b8, dwFlags=0x0) returned 1 [0209.466] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2916b8, pdwDataLen=0x2d2f984 | out: pbData=0x2916b8, pdwDataLen=0x2d2f984) returned 1 [0209.466] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0209.467] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0209.467] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0209.467] Wow64DisableWow64FsRedirection (in: OldValue=0x2d2fa6c | out: OldValue=0x2d2fa6c*=0x0) returned 1 [0209.467] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2916b8 | out: hHeap=0x290000) returned 1 [0209.467] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74d40000 [0209.467] GetProcAddress (hModule=0x74d40000, lpProcName="CreateProcessWithTokenW") returned 0x74d8531f [0209.467] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2914a0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe")) returned 0x20 [0209.467] GetShellWindow () returned 0x100f2 [0209.468] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x2d2fa74 | out: lpdwProcessId=0x2d2fa74) returned 0x460 [0209.468] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x45c) returned 0x274 [0209.468] OpenProcessToken (in: ProcessHandle=0x274, DesiredAccess=0x2000000, TokenHandle=0x2d2fa80 | out: TokenHandle=0x2d2fa80*=0x278) returned 1 [0209.468] DuplicateTokenEx (in: hExistingToken=0x278, dwDesiredAccess=0x2000000, lpTokenAttributes=0x2d2fa60, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x2d2fa7c | out: phNewToken=0x2d2fa7c*=0x27c) returned 1 [0209.468] CreateProcessWithTokenW (in: hToken=0x27c, dwLogonFlags=0x0, lpApplicationName="C:\\Windows\\SysWOW64\\nslookup.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2d2fa0c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2d2fa50 | out: lpCommandLine=0x0, lpProcessInformation=0x2d2fa50*(hProcess=0x290, hThread=0x294, dwProcessId=0x844, dwThreadId=0x848)) returned 1 [0210.185] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x50) returned 0x2916b8 [0210.185] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d2f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d2f9d0 | out: phKey=0x2d2f9d0*=0x5a2af0) returned 1 [0210.185] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2d2f9b8, dwFlags=0x0) returned 1 [0210.185] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2916b8, pdwDataLen=0x2d2f984 | out: pbData=0x2916b8, pdwDataLen=0x2d2f984) returned 1 [0210.185] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0210.185] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0210.185] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76c4d668 [0210.185] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0210.185] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2916b8 | out: hHeap=0x290000) returned 1 [0210.185] CloseHandle (hObject=0x274) returned 1 [0210.185] CloseHandle (hObject=0x290) returned 1 [0210.185] CloseHandle (hObject=0x294) returned 1 [0210.185] CloseHandle (hObject=0x278) returned 1 [0210.185] CloseHandle (hObject=0x27c) returned 1 [0210.186] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2914a0 | out: hHeap=0x290000) returned 1 Thread: id = 57 os_tid = 0x788 [0214.839] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291508 [0214.839] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2bff88c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bff8f4 | out: phKey=0x2bff8f4*=0x5a2af0) returned 1 [0214.839] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2bff8dc, dwFlags=0x0) returned 1 [0214.839] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x2bff8a8 | out: pbData=0x291508, pdwDataLen=0x2bff8a8) returned 1 [0214.839] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.839] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x14) returned 0x291530 [0214.839] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x14) returned 0x291698 [0214.839] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x2916b8 [0214.839] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2bff864, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bff8cc | out: phKey=0x2bff8cc*=0x5a2af0) returned 1 [0214.839] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2bff8b4, dwFlags=0x0) returned 1 [0214.840] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2916b8, pdwDataLen=0x2bff880 | out: pbData=0x2916b8, pdwDataLen=0x2bff880) returned 1 [0214.840] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.840] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2916b8 | out: hHeap=0x290000) returned 1 [0214.840] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x291530, nSize=0xa | out: lpDst="") returned 0x1c [0214.840] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291698 | out: hHeap=0x290000) returned 1 [0214.840] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291530, Size=0x26) returned 0x291530 [0214.840] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x26) returned 0x291698 [0214.840] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x2916c8 [0214.840] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2bff860, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bff8c8 | out: phKey=0x2bff8c8*=0x5a2af0) returned 1 [0214.840] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2bff8b0, dwFlags=0x0) returned 1 [0214.840] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2916c8, pdwDataLen=0x2bff87c | out: pbData=0x2916c8, pdwDataLen=0x2bff87c) returned 1 [0214.840] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.840] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2916c8 | out: hHeap=0x290000) returned 1 [0214.840] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x291530, nSize=0x13 | out: lpDst="") returned 0x1c [0214.840] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291698 | out: hHeap=0x290000) returned 1 [0214.840] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291530, Size=0x4a) returned 0x291698 [0214.840] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4a) returned 0x2916f0 [0214.840] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295218 [0214.840] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2bff860, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bff8c8 | out: phKey=0x2bff8c8*=0x5a2af0) returned 1 [0214.840] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2bff8b0, dwFlags=0x0) returned 1 [0214.840] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295218, pdwDataLen=0x2bff87c | out: pbData=0x295218, pdwDataLen=0x2bff87c) returned 1 [0214.840] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.840] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0214.840] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x291698, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0214.840] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2916f0 | out: hHeap=0x290000) returned 1 [0214.840] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.840] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x50) returned 0x291508 [0214.840] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2bff884, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bff8ec | out: phKey=0x2bff8ec*=0x5a2af0) returned 1 [0214.840] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2bff8d4, dwFlags=0x0) returned 1 [0214.840] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x2bff8a0 | out: pbData=0x291508, pdwDataLen=0x2bff8a0) returned 1 [0214.840] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.841] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0214.841] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0214.841] Wow64DisableWow64FsRedirection (in: OldValue=0x2bff9a4 | out: OldValue=0x2bff9a4*=0x0) returned 1 [0214.841] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.841] CreatePipe (in: hReadPipe=0x2bff9b0, hWritePipe=0x2bff9b4, lpPipeAttributes=0x2bff98c, nSize=0x0 | out: hReadPipe=0x2bff9b0*=0x284, hWritePipe=0x2bff9b4*=0x27c) returned 1 [0214.841] CreatePipe (in: hReadPipe=0x2bff9ac, hWritePipe=0x2bff9a8, lpPipeAttributes=0x2bff98c, nSize=0x0 | out: hReadPipe=0x2bff9ac*=0x278, hWritePipe=0x2bff9a8*=0x294) returned 1 [0214.841] SetHandleInformation (hObject=0x27c, dwMask=0x1, dwFlags=0x0) returned 1 [0214.841] SetHandleInformation (hObject=0x278, dwMask=0x1, dwFlags=0x0) returned 1 [0214.841] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2bff938*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x284, hStdOutput=0x294, hStdError=0x294), lpProcessInformation=0x2bff97c | out: lpCommandLine=0x0, lpProcessInformation=0x2bff97c*(hProcess=0x2a4, hThread=0x2a0, dwProcessId=0x62c, dwThreadId=0x5a4)) returned 1 [0214.863] WriteFile (in: hFile=0x27c, lpBuffer=0x291568*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x2bff998, lpOverlapped=0x0 | out: lpBuffer=0x291568*, lpNumberOfBytesWritten=0x2bff998*=0xbc, lpOverlapped=0x0) returned 1 [0214.863] WaitForSingleObject (hHandle=0x2a4, dwMilliseconds=0xffffffff) Thread: id = 58 os_tid = 0xc4 [0214.842] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291508 [0214.842] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2dafdac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2dafe14 | out: phKey=0x2dafe14*=0x5a2af0) returned 1 [0214.842] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2dafdfc, dwFlags=0x0) returned 1 [0214.842] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x2dafdc8 | out: pbData=0x291508, pdwDataLen=0x2dafdc8) returned 1 [0214.842] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x14) returned 0x291530 [0214.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x14) returned 0x2916f0 [0214.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295218 [0214.843] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2dafd84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2dafdec | out: phKey=0x2dafdec*=0x5a2af0) returned 1 [0214.843] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2dafdd4, dwFlags=0x0) returned 1 [0214.843] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295218, pdwDataLen=0x2dafda0 | out: pbData=0x295218, pdwDataLen=0x2dafda0) returned 1 [0214.843] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.843] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0214.843] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x291530, nSize=0xa | out: lpDst="") returned 0x1c [0214.843] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2916f0 | out: hHeap=0x290000) returned 1 [0214.843] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291530, Size=0x26) returned 0x291530 [0214.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x26) returned 0x2916f0 [0214.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295218 [0214.843] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2dafd80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2dafde8 | out: phKey=0x2dafde8*=0x5a2af0) returned 1 [0214.843] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2dafdd0, dwFlags=0x0) returned 1 [0214.843] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295218, pdwDataLen=0x2dafd9c | out: pbData=0x295218, pdwDataLen=0x2dafd9c) returned 1 [0214.843] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.843] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0214.843] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x291530, nSize=0x13 | out: lpDst="") returned 0x1c [0214.843] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2916f0 | out: hHeap=0x290000) returned 1 [0214.843] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291530, Size=0x4a) returned 0x2916f0 [0214.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4a) returned 0x295218 [0214.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x295270 [0214.843] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2dafd80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2dafde8 | out: phKey=0x2dafde8*=0x5a2af0) returned 1 [0214.843] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2dafdd0, dwFlags=0x0) returned 1 [0214.843] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295270, pdwDataLen=0x2dafd9c | out: pbData=0x295270, pdwDataLen=0x2dafd9c) returned 1 [0214.843] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.843] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295270 | out: hHeap=0x290000) returned 1 [0214.843] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2916f0, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0214.843] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x295218 | out: hHeap=0x290000) returned 1 [0214.843] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x50) returned 0x291508 [0214.843] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2dafda4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2dafe0c | out: phKey=0x2dafe0c*=0x5a2af0) returned 1 [0214.843] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2dafdf4, dwFlags=0x0) returned 1 [0214.843] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291508, pdwDataLen=0x2dafdc0 | out: pbData=0x291508, pdwDataLen=0x2dafdc0) returned 1 [0214.843] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0214.844] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0214.844] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0214.844] Wow64DisableWow64FsRedirection (in: OldValue=0x2dafec4 | out: OldValue=0x2dafec4*=0x0) returned 1 [0214.844] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291508 | out: hHeap=0x290000) returned 1 [0214.844] CreatePipe (in: hReadPipe=0x2dafed0, hWritePipe=0x2dafed4, lpPipeAttributes=0x2dafeac, nSize=0x0 | out: hReadPipe=0x2dafed0*=0x290, hWritePipe=0x2dafed4*=0x274) returned 1 [0214.844] CreatePipe (in: hReadPipe=0x2dafecc, hWritePipe=0x2dafec8, lpPipeAttributes=0x2dafeac, nSize=0x0 | out: hReadPipe=0x2dafecc*=0x298, hWritePipe=0x2dafec8*=0x29c) returned 1 [0214.844] SetHandleInformation (hObject=0x274, dwMask=0x1, dwFlags=0x0) returned 1 [0214.844] SetHandleInformation (hObject=0x298, dwMask=0x1, dwFlags=0x0) returned 1 [0214.844] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2dafe58*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x290, hStdOutput=0x29c, hStdError=0x29c), lpProcessInformation=0x2dafe9c | out: lpCommandLine=0x0, lpProcessInformation=0x2dafe9c*(hProcess=0x2a8, hThread=0x2ac, dwProcessId=0x780, dwThreadId=0x240)) returned 1 [0214.868] WriteFile (in: hFile=0x274, lpBuffer=0x291630*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2dafeb8, lpOverlapped=0x0 | out: lpBuffer=0x291630*, lpNumberOfBytesWritten=0x2dafeb8*=0x5b, lpOverlapped=0x0) returned 1 [0214.868] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0xffffffff) Thread: id = 94 os_tid = 0x954 [0223.182] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x440) returned 0x295320 [0223.182] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2e5f78c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f7f4 | out: phKey=0x2e5f7f4*=0x5a2af0) returned 1 [0223.182] CryptSetKeyParam (hKey=0x5a2af0, dwParam=0x1, pbData=0x2e5f7dc, dwFlags=0x0) returned 1 [0223.182] CryptDecrypt (in: hKey=0x5a2af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x295320, pdwDataLen=0x2e5f7a8 | out: pbData=0x295320, pdwDataLen=0x2e5f7a8) returned 1 [0223.182] CryptDestroyKey (hKey=0x5a2af0) returned 1 [0223.182] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x434) returned 0x295768 [0223.182] GetLastError () returned 0x57 [0223.182] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x214) returned 0x295ba8 [0223.182] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0223.182] GetCurrentThreadId () returned 0x954 [0223.182] SetLastError (dwErrCode=0x57) [0223.182] GetLastError () returned 0x57 [0223.182] SetLastError (dwErrCode=0x57) [0223.184] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.190] SetLastError (dwErrCode=0x57) [0223.190] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.191] SetLastError (dwErrCode=0x57) [0223.191] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.192] SetLastError (dwErrCode=0x57) [0223.192] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.193] SetLastError (dwErrCode=0x57) [0223.193] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.194] GetLastError () returned 0x57 [0223.194] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.195] GetLastError () returned 0x57 [0223.195] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.196] GetLastError () returned 0x57 [0223.196] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.197] SetLastError (dwErrCode=0x57) [0223.197] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.198] SetLastError (dwErrCode=0x57) [0223.198] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.199] SetLastError (dwErrCode=0x57) [0223.199] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.200] SetLastError (dwErrCode=0x57) [0223.200] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.201] GetLastError () returned 0x57 [0223.201] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.202] SetLastError (dwErrCode=0x57) [0223.202] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.203] SetLastError (dwErrCode=0x57) [0223.203] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.204] GetLastError () returned 0x57 [0223.204] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.205] SetLastError (dwErrCode=0x57) [0223.205] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.206] SetLastError (dwErrCode=0x57) [0223.206] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.207] SetLastError (dwErrCode=0x57) [0223.207] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.208] GetLastError () returned 0x57 [0223.208] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.209] GetLastError () returned 0x57 [0223.209] SetLastError (dwErrCode=0x57) [0223.210] GetLastError () returned 0x57 [0223.210] SetLastError (dwErrCode=0x57) [0223.210] GetLastError () returned 0x57 [0223.210] SetLastError (dwErrCode=0x57) [0223.210] GetLastError () returned 0x57 [0223.210] SetLastError (dwErrCode=0x57) [0223.210] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2bc [0223.213] Process32FirstW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.214] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.214] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.215] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.216] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.217] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.217] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.218] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.219] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.219] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0223.220] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.221] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.221] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.222] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.257] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.313] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.313] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.314] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.315] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.316] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.316] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.317] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0223.318] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.319] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0223.319] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0223.320] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0223.321] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0223.322] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0223.322] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0223.323] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0223.324] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0223.324] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0223.325] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0223.326] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0223.327] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0223.327] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0223.328] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0223.329] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0223.330] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0223.330] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0223.331] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0223.332] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0223.333] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.333] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.334] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0223.335] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.336] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0223.336] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0223.337] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0223.338] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.339] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.339] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.340] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.341] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.342] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0223.342] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0223.343] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0223.344] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.344] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0223.348] CloseHandle (hObject=0x2bc) returned 1 [0223.348] Sleep (dwMilliseconds=0x1f4) [0224.333] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0224.335] Process32FirstW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.336] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0224.337] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0224.338] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.338] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0224.339] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.340] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0224.341] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0224.342] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0224.342] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0224.343] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.344] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.345] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.345] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.346] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.347] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0224.348] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.349] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.349] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0224.350] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0224.351] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0224.352] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0224.352] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.353] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0224.354] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0224.355] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0224.356] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0224.356] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0224.357] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0224.358] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0224.359] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0224.359] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0224.360] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0224.361] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0224.362] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0224.362] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0224.363] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0224.364] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0224.365] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0224.365] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0224.366] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0224.367] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0224.368] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.393] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.430] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0224.444] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.445] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0224.446] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0224.447] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0224.447] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0224.448] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0224.449] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0224.450] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0224.450] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0224.451] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0224.452] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0224.453] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0224.453] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.454] Process32NextW (in: hSnapshot=0x354, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0224.455] CloseHandle (hObject=0x354) returned 1 [0224.455] Sleep (dwMilliseconds=0x1f4) [0226.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0226.218] Process32FirstW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.219] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.220] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.220] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.221] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.222] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.223] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.223] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.224] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.225] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0226.226] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.226] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.227] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.228] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.229] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.229] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0226.230] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.231] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.232] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0226.232] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0226.233] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0226.234] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0226.235] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.235] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0226.236] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0226.237] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0226.238] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0226.239] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0226.239] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0226.240] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0226.241] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0226.242] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0226.242] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0226.243] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0226.244] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0226.245] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0226.245] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0226.246] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0226.247] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0226.248] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0226.248] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0226.249] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0226.250] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0226.251] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.251] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0226.736] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.737] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0226.738] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0226.739] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0226.739] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0226.740] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0226.741] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0226.742] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0226.742] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0226.743] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0226.744] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0226.745] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0226.746] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.746] Process32NextW (in: hSnapshot=0x330, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0226.747] CloseHandle (hObject=0x330) returned 1 [0226.747] Sleep (dwMilliseconds=0x1f4) [0227.473] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0227.476] Process32FirstW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.476] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0227.477] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0227.478] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.479] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0227.480] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.480] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0227.481] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0227.482] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0227.483] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0227.484] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.484] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.485] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.486] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.487] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.487] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0227.488] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.489] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.490] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0227.491] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0227.491] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0227.492] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0227.493] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.494] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0227.494] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0227.495] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0227.496] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0227.497] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0227.497] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0227.498] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0227.499] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0227.500] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0227.501] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0227.501] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0227.502] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0227.503] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0227.504] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0227.504] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0227.505] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0227.506] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0227.507] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0227.507] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0227.508] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0227.509] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.510] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0227.510] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.511] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0227.512] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0227.513] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0227.514] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0227.514] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0227.515] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0227.516] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0227.658] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0227.660] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0227.661] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0227.662] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0227.663] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.664] Process32NextW (in: hSnapshot=0x364, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0227.665] CloseHandle (hObject=0x364) returned 1 [0227.665] Sleep (dwMilliseconds=0x1f4) [0229.712] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0229.714] Process32FirstW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.715] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0229.716] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0229.716] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.717] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0229.718] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.719] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0229.720] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0229.720] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0229.721] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0229.722] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.723] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.723] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.724] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.725] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.726] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0229.726] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.727] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.728] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0229.729] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0229.729] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0229.730] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0229.731] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.732] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0229.732] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0229.733] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0229.734] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0229.735] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0229.736] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0229.736] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0229.737] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0229.738] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0229.739] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0229.739] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0229.740] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0229.741] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0229.742] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0229.742] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0229.743] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0229.744] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0229.745] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0229.746] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0230.466] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0230.558] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.559] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0230.560] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.561] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0230.562] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0230.562] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0230.563] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.564] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.565] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.565] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.566] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.567] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0230.568] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0230.568] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0230.569] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.570] Process32NextW (in: hSnapshot=0x394, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0230.571] CloseHandle (hObject=0x394) returned 1 [0230.571] Sleep (dwMilliseconds=0x1f4) [0231.418] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0231.420] Process32FirstW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.421] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.421] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.422] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.423] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.424] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.424] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.425] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.426] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.427] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0231.427] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.428] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.429] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.430] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.431] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.432] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.432] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.433] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.434] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.435] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.435] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.436] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0231.437] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.438] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0231.438] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0231.439] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0231.440] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0231.441] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0231.441] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0231.442] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0231.443] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0231.444] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0231.444] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0231.445] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0231.446] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0231.447] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0231.448] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0231.448] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0231.449] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0231.450] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0231.451] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0231.451] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0231.452] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0231.453] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.454] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0231.454] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.455] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0231.456] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0231.457] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0231.457] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.458] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.459] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.460] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.461] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.461] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0231.714] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0231.715] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0231.716] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.717] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0231.717] CloseHandle (hObject=0x38c) returned 1 [0231.718] Sleep (dwMilliseconds=0x1f4) [0233.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0233.529] Process32FirstW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.530] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0233.531] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0233.531] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.532] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0233.533] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.534] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0233.536] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0233.537] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0233.538] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0233.539] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.539] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.540] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.541] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.542] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.542] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0233.543] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.544] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.545] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0233.545] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0233.546] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0233.547] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0233.548] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.548] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0233.549] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0233.550] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0233.551] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0233.551] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0233.552] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0233.553] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0233.554] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0233.555] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0233.555] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0233.556] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0233.557] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0233.558] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0233.558] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0233.559] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0233.560] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0233.561] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0233.561] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0233.562] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0233.563] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0233.740] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.741] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0233.742] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.743] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0233.743] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0233.744] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0233.745] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0233.746] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0233.746] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0233.747] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0233.748] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0233.749] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0233.749] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0233.750] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0233.751] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.752] Process32NextW (in: hSnapshot=0x370, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0233.752] CloseHandle (hObject=0x370) returned 1 [0233.752] Sleep (dwMilliseconds=0x1f4) [0234.434] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0234.437] Process32FirstW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.437] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.438] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.439] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.440] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.441] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.441] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.442] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.443] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.444] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0234.445] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.445] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.446] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.447] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.448] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.449] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0234.449] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.450] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.451] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.452] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.453] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.453] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0234.454] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.455] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0234.456] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0234.456] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0234.457] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0234.458] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0234.459] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0234.460] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0234.460] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0234.461] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0234.462] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0234.463] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0234.463] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0234.464] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0234.465] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0234.466] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0234.467] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0234.467] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0234.468] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0234.469] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0234.470] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0234.470] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.513] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0234.514] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.514] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0234.515] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0234.516] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0234.517] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.517] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.518] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.519] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.520] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.521] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0234.521] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0234.522] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0234.523] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.524] Process32NextW (in: hSnapshot=0x38c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0234.525] CloseHandle (hObject=0x38c) returned 1 [0234.525] Sleep (dwMilliseconds=0x1f4) [0235.981] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0235.984] Process32FirstW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.984] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0235.985] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0235.986] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.987] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0235.988] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.989] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0235.989] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0235.990] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0235.991] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0235.992] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.993] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.994] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.995] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.995] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.996] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0235.997] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.998] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.998] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0235.999] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.000] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.001] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0236.002] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.002] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0236.003] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0236.004] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0236.005] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0236.005] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0236.006] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0236.007] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0236.008] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0236.009] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0236.009] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0236.010] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0236.011] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0236.012] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0236.012] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0236.013] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0236.420] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0236.421] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0236.422] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0236.423] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0236.424] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0236.426] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.427] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0236.428] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.429] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0236.429] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0236.430] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0236.431] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.432] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0236.432] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0236.433] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.434] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.435] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0236.436] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0236.436] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0236.437] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.438] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0236.439] CloseHandle (hObject=0x374) returned 1 [0236.439] Sleep (dwMilliseconds=0x1f4) [0236.993] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0236.995] Process32FirstW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.995] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0236.996] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0236.997] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.998] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0236.999] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.000] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.001] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.001] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.002] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0237.003] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.004] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.005] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.006] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.007] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.008] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.009] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.010] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.011] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.012] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.012] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.013] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0237.014] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.015] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0237.016] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0237.017] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0237.018] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0237.019] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0237.019] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0237.020] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0237.021] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0237.022] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0237.023] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0237.024] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0237.024] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0237.025] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0237.026] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0237.027] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0237.028] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0237.047] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0237.048] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0237.049] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0237.049] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0237.050] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.051] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0237.052] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.052] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0237.053] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0237.054] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0237.055] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.056] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.057] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.058] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.058] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.059] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0237.060] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0237.061] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0237.062] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.087] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0237.088] CloseHandle (hObject=0x39c) returned 1 [0237.088] Sleep (dwMilliseconds=0x1f4) [0237.635] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0237.642] Process32FirstW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.643] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.644] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.645] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.645] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.646] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.647] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.648] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.649] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.650] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0237.651] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.651] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.652] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.653] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.654] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.655] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.656] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.657] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.662] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.663] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.663] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.664] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0237.665] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.666] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0237.666] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0237.667] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0237.668] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0237.670] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0237.670] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0237.672] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0237.673] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0237.674] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0237.674] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0237.675] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0237.676] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0237.677] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0237.677] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0237.678] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0237.679] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0237.680] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0237.680] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0237.681] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0237.682] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0237.963] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.964] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0237.965] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.966] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0237.967] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0237.968] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0237.969] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.970] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.970] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.971] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.972] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.973] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0237.973] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0237.974] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0237.975] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.976] Process32NextW (in: hSnapshot=0x380, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0237.977] CloseHandle (hObject=0x380) returned 1 [0237.977] Sleep (dwMilliseconds=0x1f4) [0238.784] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0238.787] Process32FirstW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.788] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.789] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.790] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.792] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.793] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.794] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.795] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.796] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.798] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0238.799] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.800] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.801] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.802] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.803] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.804] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.805] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.807] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.808] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.809] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.810] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.811] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0238.812] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.813] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0238.815] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0238.816] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0238.904] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0238.905] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0238.906] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0238.906] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0238.907] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0238.908] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0238.909] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0238.909] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0238.910] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0238.911] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0238.912] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0238.912] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0238.913] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0238.914] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0238.915] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0238.915] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0238.916] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0238.917] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.918] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0238.919] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.920] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0238.921] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0238.921] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0238.922] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.923] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0238.924] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0238.924] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.925] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.926] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0238.927] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0238.928] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0238.928] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.929] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0238.930] CloseHandle (hObject=0x374) returned 1 [0238.930] Sleep (dwMilliseconds=0x1f4) [0240.490] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0240.657] Process32FirstW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.660] GetLastError () returned 0x12 [0240.666] SetLastError (dwErrCode=0x12) [0240.666] GetLastError () returned 0x12 [0240.677] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0240.727] GetLastError () returned 0x12 [0240.727] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0240.728] GetLastError () returned 0x12 [0240.728] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.729] GetLastError () returned 0x12 [0240.729] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0240.730] GetLastError () returned 0x12 [0240.730] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.730] GetLastError () returned 0x12 [0240.731] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0240.731] GetLastError () returned 0x12 [0240.731] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0240.732] GetLastError () returned 0x12 [0240.732] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0240.733] GetLastError () returned 0x12 [0240.733] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0240.734] GetLastError () returned 0x12 [0240.734] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.734] GetLastError () returned 0x12 [0240.734] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.735] GetLastError () returned 0x12 [0240.735] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.736] GetLastError () returned 0x12 [0240.736] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.737] GetLastError () returned 0x12 [0240.737] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.737] GetLastError () returned 0x12 [0240.738] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.738] GetLastError () returned 0x12 [0240.738] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.739] GetLastError () returned 0x12 [0240.739] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.740] GetLastError () returned 0x12 [0240.740] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.741] GetLastError () returned 0x12 [0240.741] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.741] GetLastError () returned 0x12 [0240.741] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.742] GetLastError () returned 0x12 [0240.742] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0240.743] GetLastError () returned 0x12 [0240.743] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.744] GetLastError () returned 0x12 [0240.744] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0240.744] GetLastError () returned 0x12 [0240.745] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0240.745] GetLastError () returned 0x12 [0240.745] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0240.746] GetLastError () returned 0x12 [0240.746] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0240.747] GetLastError () returned 0x12 [0240.747] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0240.748] GetLastError () returned 0x12 [0240.748] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0240.748] GetLastError () returned 0x12 [0240.748] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0240.749] GetLastError () returned 0x12 [0240.749] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0240.750] GetLastError () returned 0x12 [0240.750] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0240.751] GetLastError () returned 0x12 [0240.751] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0240.751] GetLastError () returned 0x12 [0240.751] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0240.752] GetLastError () returned 0x12 [0240.752] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0241.120] GetLastError () returned 0x12 [0241.120] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0241.121] GetLastError () returned 0x12 [0241.121] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0241.121] GetLastError () returned 0x12 [0241.121] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0241.122] GetLastError () returned 0x12 [0241.122] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0241.123] GetLastError () returned 0x12 [0241.123] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0241.124] GetLastError () returned 0x12 [0241.124] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0241.125] GetLastError () returned 0x12 [0241.125] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0241.126] GetLastError () returned 0x12 [0241.126] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0241.126] GetLastError () returned 0x12 [0241.126] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.127] GetLastError () returned 0x12 [0241.127] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0241.128] GetLastError () returned 0x12 [0241.128] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.129] GetLastError () returned 0x12 [0241.129] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0241.129] GetLastError () returned 0x12 [0241.130] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0241.130] GetLastError () returned 0x12 [0241.130] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0241.131] GetLastError () returned 0x12 [0241.131] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.132] GetLastError () returned 0x12 [0241.132] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0241.133] GetLastError () returned 0x12 [0241.133] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0241.133] GetLastError () returned 0x12 [0241.133] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.134] GetLastError () returned 0x12 [0241.134] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.135] GetLastError () returned 0x12 [0241.135] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0241.136] GetLastError () returned 0x12 [0241.136] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0241.137] GetLastError () returned 0x12 [0241.137] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0241.138] GetLastError () returned 0x12 [0241.138] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.139] GetLastError () returned 0x12 [0241.139] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0241.139] GetLastError () returned 0x12 [0241.139] Process32NextW (in: hSnapshot=0x39c, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0241.140] CloseHandle (hObject=0x39c) returned 1 [0241.140] Sleep (dwMilliseconds=0x1f4) [0242.012] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0242.014] Process32FirstW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.015] GetLastError () returned 0x12 [0242.015] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.016] GetLastError () returned 0x12 [0242.016] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.017] GetLastError () returned 0x12 [0242.017] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.018] GetLastError () returned 0x12 [0242.018] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.019] GetLastError () returned 0x12 [0242.019] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.019] GetLastError () returned 0x12 [0242.020] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.020] GetLastError () returned 0x12 [0242.020] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.021] GetLastError () returned 0x12 [0242.021] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.022] GetLastError () returned 0x12 [0242.022] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0242.023] GetLastError () returned 0x12 [0242.023] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.023] GetLastError () returned 0x12 [0242.023] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.024] GetLastError () returned 0x12 [0242.024] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.025] GetLastError () returned 0x12 [0242.025] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.026] GetLastError () returned 0x12 [0242.026] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.027] GetLastError () returned 0x12 [0242.027] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.027] GetLastError () returned 0x12 [0242.027] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.028] GetLastError () returned 0x12 [0242.028] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.029] GetLastError () returned 0x12 [0242.029] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.030] GetLastError () returned 0x12 [0242.030] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.031] GetLastError () returned 0x12 [0242.031] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.031] GetLastError () returned 0x12 [0242.031] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0242.032] GetLastError () returned 0x12 [0242.032] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.033] GetLastError () returned 0x12 [0242.033] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0242.034] GetLastError () returned 0x12 [0242.034] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="treasury.exe")) returned 1 [0242.035] GetLastError () returned 0x12 [0242.035] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tony-optical-therapist.exe")) returned 1 [0242.035] GetLastError () returned 0x12 [0242.035] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="matingwashaccommodations.exe")) returned 1 [0242.036] GetLastError () returned 0x12 [0242.036] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kill.exe")) returned 1 [0242.037] GetLastError () returned 0x12 [0242.037] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrestling proud repair.exe")) returned 1 [0242.038] GetLastError () returned 0x12 [0242.038] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalog.exe")) returned 1 [0242.039] GetLastError () returned 0x12 [0242.039] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fee watt.exe")) returned 1 [0242.040] GetLastError () returned 0x12 [0242.040] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawrence pm.exe")) returned 1 [0242.040] GetLastError () returned 0x12 [0242.041] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="partner-keeps.exe")) returned 1 [0242.041] GetLastError () returned 0x12 [0242.041] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunning.exe")) returned 1 [0242.042] GetLastError () returned 0x12 [0242.042] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0242.043] GetLastError () returned 0x12 [0242.043] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flat.exe")) returned 1 [0242.044] GetLastError () returned 0x12 [0242.044] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spend-huge-fell.exe")) returned 1 [0242.044] GetLastError () returned 0x12 [0242.044] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="prototype_downtown_columns.exe")) returned 1 [0242.045] GetLastError () returned 0x12 [0242.045] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specialized_test.exe")) returned 1 [0242.046] GetLastError () returned 0x12 [0242.046] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hi-graduated.exe")) returned 1 [0242.047] GetLastError () returned 0x12 [0242.047] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cases_surprising_essentially.exe")) returned 1 [0242.214] GetLastError () returned 0x12 [0242.215] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cleaners.exe")) returned 1 [0242.215] GetLastError () returned 0x12 [0242.215] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0242.216] GetLastError () returned 0x12 [0242.216] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.217] GetLastError () returned 0x12 [0242.217] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0242.218] GetLastError () returned 0x12 [0242.218] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.219] GetLastError () returned 0x12 [0242.219] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0242.219] GetLastError () returned 0x12 [0242.219] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0242.220] GetLastError () returned 0x12 [0242.220] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nslookup.exe")) returned 1 [0242.221] GetLastError () returned 0x12 [0242.221] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.222] GetLastError () returned 0x12 [0242.222] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.223] GetLastError () returned 0x12 [0242.223] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.223] GetLastError () returned 0x12 [0242.223] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.224] GetLastError () returned 0x12 [0242.224] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.225] GetLastError () returned 0x12 [0242.225] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x62c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0242.226] GetLastError () returned 0x12 [0242.226] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x780, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0242.227] GetLastError () returned 0x12 [0242.227] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0242.228] GetLastError () returned 0x12 [0242.228] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.228] GetLastError () returned 0x12 [0242.229] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0242.229] GetLastError () returned 0x12 [0242.229] Process32NextW (in: hSnapshot=0x374, lppe=0x2e5f5c4 | out: lppe=0x2e5f5c4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0242.230] CloseHandle (hObject=0x374) returned 1 [0242.230] Sleep (dwMilliseconds=0x1f4) Thread: id = 95 os_tid = 0x900 [0223.232] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x21a) returned 0x295dc8 [0223.232] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x296ec8 [0223.232] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0223.232] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4 [0223.232] GetComputerNameW (in: lpBuffer=0x295dd8, nSize=0x2fefe98 | out: lpBuffer="XDUWTFONO", nSize=0x2fefe98) returned 1 [0223.232] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x26) returned 0x297d38 [0223.232] GetLastError () returned 0xcb [0223.232] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x214) returned 0x298210 [0223.233] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0223.233] GetCurrentThreadId () returned 0x900 [0223.233] SetLastError (dwErrCode=0xcb) [0223.233] GetLastError () returned 0xcb [0223.233] SetLastError (dwErrCode=0xcb) [0223.233] GetLastError () returned 0xcb [0223.233] SetLastError (dwErrCode=0xcb) [0223.233] GetLastError () returned 0xcb [0223.233] SetLastError (dwErrCode=0xcb) [0223.233] GetLastError () returned 0xcb [0223.233] SetLastError (dwErrCode=0xcb) [0223.233] GetLastError () returned 0xcb [0223.233] SetLastError (dwErrCode=0xcb) [0223.233] GetLastError () returned 0xcb [0223.233] SetLastError (dwErrCode=0xcb) [0223.233] GetLastError () returned 0xcb [0223.233] SetLastError (dwErrCode=0xcb) [0223.233] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] GetLastError () returned 0xcb [0223.234] SetLastError (dwErrCode=0xcb) [0223.234] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4000) returned 0x298430 [0223.237] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x2ff0048 [0223.238] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2fefe5c | out: lphEnum=0x2fefe5c*=0x587f18) returned 0x0 [0230.464] WNetEnumResourceW (in: hEnum=0x587f18, lpcCount=0x2fefe54, lpBuffer=0x298430, lpBufferSize=0x2fefe60 | out: lpcCount=0x2fefe54, lpBuffer=0x298430, lpBufferSize=0x2fefe60) returned 0x103 [0230.464] WNetCloseEnum (hEnum=0x587f18) returned 0x0 [0230.464] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x298430 | out: hHeap=0x290000) returned 1 [0230.464] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ff0048 | out: hHeap=0x290000) returned 1 [0230.464] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4000) returned 0x298430 [0230.464] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x2ff0048 [0230.464] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2fefe44 | out: lphEnum=0x2fefe44*=0x5b4218) returned 0x0 [0230.464] WNetEnumResourceW (in: hEnum=0x5b4218, lpcCount=0x2fefe3c, lpBuffer=0x298430, lpBufferSize=0x2fefe48 | out: lpcCount=0x2fefe3c, lpBuffer=0x298430, lpBufferSize=0x2fefe48) returned 0x103 [0230.464] WNetCloseEnum (hEnum=0x5b4218) returned 0x0 [0230.465] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x298430 | out: hHeap=0x290000) returned 1 [0230.465] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ff0048 | out: hHeap=0x290000) returned 1 [0230.465] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4000) returned 0x298430 [0230.465] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x2ff0048 [0230.465] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2fefe2c) Thread: id = 96 os_tid = 0x8ec [0223.235] GetLogicalDrives () returned 0x4 [0223.235] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x297d68 [0223.239] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4fa30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fa98 | out: phKey=0x2d4fa98*=0x5a2b70) returned 1 [0223.239] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4fa80, dwFlags=0x0) returned 1 [0223.239] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297d68, pdwDataLen=0x2d4fa4c | out: pbData=0x297d68, pdwDataLen=0x2d4fa4c) returned 1 [0223.239] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.239] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x295ff0 [0223.240] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2cc [0223.240] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d0 [0223.240] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x296ef8 [0223.240] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f9fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fa64 | out: phKey=0x2d4fa64*=0x5a2b70) returned 1 [0223.240] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4fa4c, dwFlags=0x0) returned 1 [0223.240] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296ef8, pdwDataLen=0x2d4fa18 | out: pbData=0x296ef8, pdwDataLen=0x2d4fa18) returned 1 [0223.240] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.240] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x291540 [0223.240] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x296020 [0223.240] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x297eb0 [0223.240] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f9d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fa3c | out: phKey=0x2d4fa3c*=0x5a2b70) returned 1 [0223.240] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4fa24, dwFlags=0x0) returned 1 [0223.240] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297eb0, pdwDataLen=0x2d4f9f0 | out: pbData=0x297eb0, pdwDataLen=0x2d4f9f0) returned 1 [0223.240] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.240] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297eb0 | out: hHeap=0x290000) returned 1 [0223.240] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x291540, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0223.240] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296020 | out: hHeap=0x290000) returned 1 [0223.240] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296ef8 | out: hHeap=0x290000) returned 1 [0223.240] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4faa4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4faa4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.240] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291540 | out: hHeap=0x290000) returned 1 [0223.240] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x291748 [0223.240] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f940, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f9a8 | out: phKey=0x2d4f9a8*=0x5a2b70) returned 1 [0223.240] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f990, dwFlags=0x0) returned 1 [0223.240] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291748, pdwDataLen=0x2d4f95c | out: pbData=0x291748, pdwDataLen=0x2d4f95c) returned 1 [0223.241] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x291540 [0223.241] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f938, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f9a0 | out: phKey=0x2d4f9a0*=0x5a2b70) returned 1 [0223.241] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f988, dwFlags=0x0) returned 1 [0223.241] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291540, pdwDataLen=0x2d4f954 | out: pbData=0x291540, pdwDataLen=0x2d4f954) returned 1 [0223.241] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x296ef8 [0223.241] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f930, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f998 | out: phKey=0x2d4f998*=0x5a2b70) returned 1 [0223.241] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f980, dwFlags=0x0) returned 1 [0223.241] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296ef8, pdwDataLen=0x2d4f94c | out: pbData=0x296ef8, pdwDataLen=0x2d4f94c) returned 1 [0223.241] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x297eb0 [0223.241] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f928, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f990 | out: phKey=0x2d4f990*=0x5a2b70) returned 1 [0223.241] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f978, dwFlags=0x0) returned 1 [0223.241] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297eb0, pdwDataLen=0x2d4f944 | out: pbData=0x297eb0, pdwDataLen=0x2d4f944) returned 1 [0223.241] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x296020 [0223.241] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f920, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f988 | out: phKey=0x2d4f988*=0x5a2b70) returned 1 [0223.241] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f970, dwFlags=0x0) returned 1 [0223.241] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296020, pdwDataLen=0x2d4f93c | out: pbData=0x296020, pdwDataLen=0x2d4f93c) returned 1 [0223.241] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.241] htonl (hostlong=0x9c354b42) returned 0x424b359c [0223.241] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x20, pbBuffer=0x2d4fa50 | out: pbBuffer=0x2d4fa50) returned 1 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x28) returned 0x296038 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x296068 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4) returned 0x296f10 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x14) returned 0x296080 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x297f48 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x80) returned 0x2960c8 [0223.241] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x297f60 [0223.242] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x82) returned 0x296150 [0223.242] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x297f78 [0223.242] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4) returned 0x291558 [0223.242] CryptAcquireContextW (in: phProv=0x40fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x40fcf4*=0x5a3950) returned 1 [0223.245] CryptGenRandom (in: hProv=0x5a3950, dwLen=0x55, pbBuffer=0x2d4f9d2 | out: pbBuffer=0x2d4f9d2) returned 1 [0223.245] GetLastError () returned 0x0 [0223.245] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x214) returned 0x29c438 [0223.246] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0223.246] GetCurrentThreadId () returned 0x8ec [0223.246] SetLastError (dwErrCode=0x0) [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x297f90 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x80) returned 0x2961e0 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c670 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x2) returned 0x297db0 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4) returned 0x297fa8 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c688 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x80) returned 0x29ce58 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c6a0 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4) returned 0x297fb8 [0223.246] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x297db0, Size=0x82) returned 0x29cee0 [0223.246] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x297fb8, Size=0x100) returned 0x29cf70 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c6b8 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x82) returned 0x29d078 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c6d0 [0223.246] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x82) returned 0x29d108 [0223.246] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x29cee0, Size=0x104) returned 0x29d198 [0223.246] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x29cf70, Size=0x200) returned 0x29d2a8 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297fa8 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29d2a8 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c6a0 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2961e0 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f90 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce58 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c688 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29d198 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c670 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29d078 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c6b8 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29d108 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c6d0 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296f10 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296068 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296150 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f60 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2960c8 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f48 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291558 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f78 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296038 | out: hHeap=0x290000) returned 1 [0223.247] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296080 | out: hHeap=0x290000) returned 1 [0223.247] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xa4) returned 0x2960c8 [0223.248] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291540 | out: hHeap=0x290000) returned 1 [0223.248] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296ef8 | out: hHeap=0x290000) returned 1 [0223.248] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297eb0 | out: hHeap=0x290000) returned 1 [0223.248] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296020 | out: hHeap=0x290000) returned 1 [0223.248] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x14) returned 0x296ef8 [0223.248] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe) returned 0x29c6d0 [0223.248] ResetEvent (hEvent=0x2d0) returned 1 [0223.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x403bdf, lpParameter=0x296ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0223.250] CloseHandle (hObject=0x2d4) returned 1 [0223.250] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c6b8 [0223.251] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f940, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f9a8 | out: phKey=0x2d4f9a8*=0x5a2b70) returned 1 [0223.251] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f990, dwFlags=0x0) returned 1 [0223.251] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29c6b8, pdwDataLen=0x2d4f95c | out: pbData=0x29c6b8, pdwDataLen=0x2d4f95c) returned 1 [0223.251] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c670 [0223.251] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f938, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f9a0 | out: phKey=0x2d4f9a0*=0x5a2b70) returned 1 [0223.251] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f988, dwFlags=0x0) returned 1 [0223.251] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29c670, pdwDataLen=0x2d4f954 | out: pbData=0x29c670, pdwDataLen=0x2d4f954) returned 1 [0223.251] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c688 [0223.251] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f930, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f998 | out: phKey=0x2d4f998*=0x5a2b70) returned 1 [0223.251] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f980, dwFlags=0x0) returned 1 [0223.251] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29c688, pdwDataLen=0x2d4f94c | out: pbData=0x29c688, pdwDataLen=0x2d4f94c) returned 1 [0223.251] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x297eb0 [0223.251] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f928, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f990 | out: phKey=0x2d4f990*=0x5a2b70) returned 1 [0223.251] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f978, dwFlags=0x0) returned 1 [0223.251] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297eb0, pdwDataLen=0x2d4f944 | out: pbData=0x297eb0, pdwDataLen=0x2d4f944) returned 1 [0223.251] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c6a0 [0223.251] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2d4f920, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4f988 | out: phKey=0x2d4f988*=0x5a2b70) returned 1 [0223.251] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2d4f970, dwFlags=0x0) returned 1 [0223.251] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29c6a0, pdwDataLen=0x2d4f93c | out: pbData=0x29c6a0, pdwDataLen=0x2d4f93c) returned 1 [0223.251] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.251] htonl (hostlong=0x9c354b42) returned 0x424b359c [0223.251] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x20, pbBuffer=0x2d4fa50 | out: pbBuffer=0x2d4fa50) returned 1 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x28) returned 0x297f48 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c6e8 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4) returned 0x297db0 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x14) returned 0x291540 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c700 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x80) returned 0x296178 [0223.251] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c718 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x82) returned 0x296200 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c730 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4) returned 0x29d670 [0223.252] CryptGenRandom (in: hProv=0x5a3950, dwLen=0x55, pbBuffer=0x2d4f9d2 | out: pbBuffer=0x2d4f9d2) returned 1 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c748 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x80) returned 0x29da58 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c760 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x2) returned 0x29d680 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4) returned 0x29d690 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c778 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x80) returned 0x29dae0 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c790 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x4) returned 0x29d6a0 [0223.252] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x29d680, Size=0x82) returned 0x29db68 [0223.252] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x29d6a0, Size=0x100) returned 0x29dbf8 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c7a8 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x82) returned 0x29dd00 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10) returned 0x29c7c0 [0223.252] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x82) returned 0x29dd90 [0223.252] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x29db68, Size=0x104) returned 0x29de20 [0223.252] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x29dbf8, Size=0x200) returned 0x300a8b8 [0223.253] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29d690 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x300a8b8 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c790 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29da58 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c748 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29dae0 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c778 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de20 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c760 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29dd00 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c7a8 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29dd90 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c7c0 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297db0 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c6e8 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296200 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c718 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x296178 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c700 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29d670 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c730 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f48 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291540 | out: hHeap=0x290000) returned 1 [0223.254] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xa4) returned 0x296178 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c670 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c688 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297eb0 | out: hHeap=0x290000) returned 1 [0223.254] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29c6a0 | out: hHeap=0x290000) returned 1 [0223.254] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x14) returned 0x291540 [0223.254] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe) returned 0x29c6a0 [0223.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x403bdf, lpParameter=0x291540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0223.256] CloseHandle (hObject=0x2d4) returned 1 [0223.256] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) Thread: id = 97 os_tid = 0x90c [0223.235] GetLogicalDrives () returned 0x4 [0223.235] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20) returned 0x291540 [0223.248] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2c3fd34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2c3fd9c | out: phKey=0x2c3fd9c*=0x5a2b70) returned 1 [0223.249] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2c3fd84, dwFlags=0x0) returned 1 [0223.249] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x291540, pdwDataLen=0x2c3fd50 | out: pbData=0x291540, pdwDataLen=0x2c3fd50) returned 1 [0223.249] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.249] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x29ce70 [0223.249] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1e) returned 0x29ce98 [0223.249] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x90) returned 0x297eb0 [0223.249] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2c3fd0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2c3fd74 | out: phKey=0x2c3fd74*=0x5a2b70) returned 1 [0223.249] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2c3fd5c, dwFlags=0x0) returned 1 [0223.249] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297eb0, pdwDataLen=0x2c3fd28 | out: pbData=0x297eb0, pdwDataLen=0x2c3fd28) returned 1 [0223.249] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297eb0 | out: hHeap=0x290000) returned 1 [0223.249] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29ce70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0223.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce98 | out: hHeap=0x290000) returned 1 [0223.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291540 | out: hHeap=0x290000) returned 1 [0223.249] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2c3fddc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2c3fddc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.249] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29ce70 | out: hHeap=0x290000) returned 1 [0223.249] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x40) returned 0x296020 [0223.249] CryptImportKey (in: hProv=0x5a37b8, pbData=0x2c3fd68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2c3fdd0 | out: phKey=0x2c3fdd0*=0x5a2b70) returned 1 [0223.249] CryptSetKeyParam (hKey=0x5a2b70, dwParam=0x1, pbData=0x2c3fdb8, dwFlags=0x0) returned 1 [0223.249] CryptDecrypt (in: hKey=0x5a2b70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296020, pdwDataLen=0x2c3fd84 | out: pbData=0x296020, pdwDataLen=0x2c3fd84) returned 1 [0223.249] CryptDestroyKey (hKey=0x5a2b70) returned 1 [0223.249] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x296068 [0223.250] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d8 [0223.250] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2dc [0223.250] GetLogicalDrives () returned 0x4 [0223.250] Sleep (dwMilliseconds=0x3e8) [0224.609] GetLogicalDrives () returned 0x4 [0224.609] Sleep (dwMilliseconds=0x3e8) [0226.287] GetLogicalDrives () returned 0x4 [0226.287] Sleep (dwMilliseconds=0x3e8) [0227.622] GetLogicalDrives () returned 0x4 [0227.622] Sleep (dwMilliseconds=0x3e8) [0229.748] GetLogicalDrives () returned 0x4 [0229.748] Sleep (dwMilliseconds=0x3e8) [0231.135] GetLogicalDrives () returned 0x4 [0231.136] Sleep (dwMilliseconds=0x3e8) [0233.527] GetLogicalDrives () returned 0x4 [0233.527] Sleep (dwMilliseconds=0x3e8) [0234.722] GetLogicalDrives () returned 0x4 [0234.722] Sleep (dwMilliseconds=0x3e8) [0236.016] GetLogicalDrives () returned 0x4 [0236.016] Sleep (dwMilliseconds=0x3e8) [0237.629] GetLogicalDrives () returned 0x4 [0237.629] Sleep (dwMilliseconds=0x3e8) [0239.016] GetLogicalDrives () returned 0x4 [0239.016] Sleep (dwMilliseconds=0x3e8) [0240.757] GetLogicalDrives () returned 0x4 [0240.757] Sleep (dwMilliseconds=0x3e8) [0242.049] GetLogicalDrives () returned 0x4 [0242.049] Sleep (dwMilliseconds=0x3e8) Thread: id = 98 os_tid = 0x8f0 [0223.461] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x38) returned 0x296228 [0223.461] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x18) returned 0x296268 [0223.461] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d4 [0223.461] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0223.461] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e4 [0223.461] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x300a8b8 [0223.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x403a08, lpParameter=0x31ffd44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0223.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x403a08, lpParameter=0x31ffd44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0223.465] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x302a8c8 [0223.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5a2b70 [0223.466] GetLastError () returned 0x0 [0223.466] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x214) returned 0x29da58 [0223.466] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0223.466] GetCurrentThreadId () returned 0x8f0 [0223.466] SetLastError (dwErrCode=0x0) [0223.466] GetLastError () returned 0x0 [0223.466] SetLastError (dwErrCode=0x0) [0223.466] GetLastError () returned 0x0 [0223.466] SetLastError (dwErrCode=0x0) [0223.466] GetLastError () returned 0x0 [0223.466] SetLastError (dwErrCode=0x0) [0223.466] GetLastError () returned 0x0 [0223.466] SetLastError (dwErrCode=0x0) [0223.467] GetLastError () returned 0x0 [0223.467] SetLastError (dwErrCode=0x0) [0223.467] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x303a8d0 [0223.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2bf0 [0223.467] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0223.467] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0223.467] GetLastError () returned 0x0 [0223.467] SetLastError (dwErrCode=0x0) [0223.467] GetLastError () returned 0x0 [0223.467] SetLastError (dwErrCode=0x0) [0223.468] GetLastError () returned 0x0 [0223.468] SetLastError (dwErrCode=0x0) [0223.468] GetLastError () returned 0x0 [0223.468] SetLastError (dwErrCode=0x0) [0223.468] GetLastError () returned 0x0 [0223.468] SetLastError (dwErrCode=0x0) [0223.468] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x304a8d8 [0223.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2c30 [0223.469] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.469] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0223.469] GetLastError () returned 0x0 [0223.469] SetLastError (dwErrCode=0x0) [0223.469] GetLastError () returned 0x0 [0223.469] SetLastError (dwErrCode=0x0) [0223.469] GetLastError () returned 0x0 [0223.469] SetLastError (dwErrCode=0x0) [0223.469] GetLastError () returned 0x0 [0223.469] SetLastError (dwErrCode=0x0) [0223.469] GetLastError () returned 0x0 [0223.469] SetLastError (dwErrCode=0x0) [0223.469] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.470] SetLastError (dwErrCode=0x0) [0223.470] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.471] SetLastError (dwErrCode=0x0) [0223.471] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.472] SetLastError (dwErrCode=0x0) [0223.472] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.473] SetLastError (dwErrCode=0x0) [0223.473] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.474] SetLastError (dwErrCode=0x0) [0223.474] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.475] SetLastError (dwErrCode=0x0) [0223.475] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.476] SetLastError (dwErrCode=0x0) [0223.476] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.477] GetLastError () returned 0x0 [0223.477] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.478] GetLastError () returned 0x0 [0223.478] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.479] GetLastError () returned 0x0 [0223.479] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.480] GetLastError () returned 0x0 [0223.480] SetLastError (dwErrCode=0x0) [0223.481] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0223.481] FindClose (in: hFindFile=0x5a2c30 | out: hFindFile=0x5a2c30) returned 1 [0223.481] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.481] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0223.481] FindClose (in: hFindFile=0x5a2bf0 | out: hFindFile=0x5a2bf0) returned 1 [0223.481] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0223.482] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0223.482] GetLastError () returned 0x12 [0223.482] SetLastError (dwErrCode=0x12) [0223.482] GetLastError () returned 0x12 [0223.482] SetLastError (dwErrCode=0x12) [0223.482] GetLastError () returned 0x12 [0223.482] SetLastError (dwErrCode=0x12) [0223.482] GetLastError () returned 0x12 [0223.482] SetLastError (dwErrCode=0x12) [0223.482] GetLastError () returned 0x12 [0223.482] SetLastError (dwErrCode=0x12) [0223.482] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x303a8d0 [0223.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2bf0 [0223.482] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0223.482] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD", cAlternateFileName="")) returned 1 [0223.482] GetLastError () returned 0x12 [0223.482] SetLastError (dwErrCode=0x12) [0223.482] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.483] GetLastError () returned 0x12 [0223.483] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] SetEvent (hEvent=0x2bc) returned 1 [0223.484] ResetEvent (hEvent=0x2e4) returned 1 [0223.484] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.484] SetLastError (dwErrCode=0x12) [0223.484] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.485] SetLastError (dwErrCode=0x12) [0223.485] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.486] SetLastError (dwErrCode=0x12) [0223.486] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.487] SetLastError (dwErrCode=0x12) [0223.487] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.488] SetLastError (dwErrCode=0x12) [0223.488] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.489] SetLastError (dwErrCode=0x12) [0223.489] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.490] SetLastError (dwErrCode=0x12) [0223.490] GetLastError () returned 0x12 [0223.491] SetLastError (dwErrCode=0x12) [0223.491] GetLastError () returned 0x12 [0223.491] SetLastError (dwErrCode=0x12) [0223.491] GetLastError () returned 0x12 [0223.491] SetLastError (dwErrCode=0x12) [0223.491] GetLastError () returned 0x12 [0223.491] SetLastError (dwErrCode=0x12) [0223.491] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0223.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.522] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.527] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.535] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.539] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.539] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.540] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="da-DK", cAlternateFileName="")) returned 1 [0223.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.540] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.540] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.540] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.540] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.540] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.540] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="de-DE", cAlternateFileName="")) returned 1 [0223.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.540] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.541] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.541] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.541] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.541] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.541] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="el-GR", cAlternateFileName="")) returned 1 [0223.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.541] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.541] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.541] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.541] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.541] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.541] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="en-US", cAlternateFileName="")) returned 1 [0223.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.541] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.541] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.542] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.542] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.542] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.542] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.542] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="es-ES", cAlternateFileName="")) returned 1 [0223.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.542] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.542] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.542] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.542] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.542] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.542] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0223.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.542] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.542] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.543] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.543] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.543] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.543] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Fonts", cAlternateFileName="")) returned 1 [0223.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.543] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.543] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0223.543] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0223.543] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0223.543] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0223.543] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0223.543] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0223.543] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.544] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.544] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0223.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.544] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.544] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.544] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.544] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.544] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.544] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0223.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.544] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.544] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.544] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.544] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.544] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.544] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="it-IT", cAlternateFileName="")) returned 1 [0223.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.545] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.545] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.545] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.545] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.545] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.545] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0223.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.545] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.545] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.545] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.545] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.545] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.545] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0223.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.546] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.546] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.546] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.546] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.546] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.546] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x44, dwReserved1=0x44, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0223.546] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0223.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.546] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.546] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.546] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.546] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.546] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.546] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0223.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.547] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.547] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.547] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.547] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.547] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.547] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0223.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.547] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.547] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.547] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.547] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.547] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.547] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0223.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.547] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.548] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.548] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.548] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.548] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.548] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0223.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.548] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.548] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.548] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.548] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.548] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.548] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0223.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.548] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.548] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.549] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.549] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.549] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.549] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0223.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.549] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.549] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.549] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.549] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.549] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.549] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0223.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.552] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.552] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.552] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.552] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.552] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.552] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0223.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.552] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.552] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.553] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.553] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.553] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.553] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0223.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.554] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.554] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.554] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.554] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.554] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.554] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0223.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.554] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.554] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.555] GetLastError () returned 0x12 [0223.555] SetLastError (dwErrCode=0x12) [0223.555] GetLastError () returned 0x12 [0223.555] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.555] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.555] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0223.555] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0223.555] FindClose (in: hFindFile=0x5a2bf0 | out: hFindFile=0x5a2bf0) returned 1 [0223.555] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0223.555] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0223.555] GetLastError () returned 0x12 [0223.555] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0223.555] GetLastError () returned 0x12 [0223.555] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0223.555] GetLastError () returned 0x12 [0223.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2bf0 [0223.556] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0223.556] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 0 [0223.556] FindClose (in: hFindFile=0x5a2bf0 | out: hFindFile=0x5a2bf0) returned 1 [0223.556] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0223.556] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0223.556] GetLastError () returned 0x12 [0223.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="\xfd44\x31f\xa8c8\x302\x5c\x5c\x3f\x5c\xa8d6\x302\xfa94\x31f\x39c8\x40\x08\x01\xa8d0\x302")) returned 0xffffffff [0223.557] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0223.557] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0223.557] GetLastError () returned 0x5 [0223.557] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0223.557] GetLastError () returned 0x5 [0223.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2bf0 [0223.557] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0223.557] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0223.558] GetLastError () returned 0x5 [0223.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.559] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.560] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0223.560] GetLastError () returned 0x5 [0223.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.561] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.561] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0223.562] GetLastError () returned 0x5 [0223.562] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0223.562] GetLastError () returned 0x5 [0223.562] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0223.562] GetLastError () returned 0x5 [0223.562] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.562] GetLastError () returned 0x5 [0223.562] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.562] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.562] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x308a8f8 | out: hHeap=0x290000) returned 1 [0223.562] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0223.562] GetLastError () returned 0x12 [0223.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.564] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.564] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0223.564] GetLastError () returned 0x12 [0223.564] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0223.565] GetLastError () returned 0x12 [0223.565] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0223.565] GetLastError () returned 0x12 [0223.565] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.565] GetLastError () returned 0x12 [0223.565] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.565] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.566] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x308a8f8 | out: hHeap=0x290000) returned 1 [0223.567] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0223.567] GetLastError () returned 0x12 [0223.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.570] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.570] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0223.570] GetLastError () returned 0x12 [0223.570] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0223.570] GetLastError () returned 0x12 [0223.570] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0223.570] GetLastError () returned 0x12 [0223.570] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.570] GetLastError () returned 0x12 [0223.570] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.570] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.571] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.571] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0223.571] GetLastError () returned 0x12 [0223.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.573] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.573] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0223.573] GetLastError () returned 0x12 [0223.573] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0223.573] GetLastError () returned 0x12 [0223.573] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0223.573] GetLastError () returned 0x12 [0223.573] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.573] GetLastError () returned 0x12 [0223.573] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.573] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.574] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.575] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0223.575] GetLastError () returned 0x12 [0223.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.576] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.576] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.576] GetLastError () returned 0x12 [0223.576] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0223.576] GetLastError () returned 0x12 [0223.576] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0223.576] GetLastError () returned 0x12 [0223.576] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0223.576] GetLastError () returned 0x12 [0223.576] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0223.576] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.576] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.576] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0223.576] GetLastError () returned 0x12 [0223.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.578] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.578] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0223.578] GetLastError () returned 0x12 [0223.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.579] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.579] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0223.579] GetLastError () returned 0x12 [0223.579] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0223.579] GetLastError () returned 0x12 [0223.579] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0223.579] GetLastError () returned 0x12 [0223.579] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0223.580] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.580] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.580] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0223.580] GetLastError () returned 0x12 [0223.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.581] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.581] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0223.581] GetLastError () returned 0x12 [0223.581] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0223.581] GetLastError () returned 0x12 [0223.581] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0223.581] GetLastError () returned 0x12 [0223.581] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0223.581] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.581] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.581] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0223.581] GetLastError () returned 0x12 [0223.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.581] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.581] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0223.581] GetLastError () returned 0x12 [0223.582] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0223.582] GetLastError () returned 0x12 [0223.582] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0223.582] GetLastError () returned 0x12 [0223.582] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0223.582] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.582] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.582] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0223.582] GetLastError () returned 0x12 [0223.582] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0223.582] GetLastError () returned 0x12 [0223.582] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.582] GetLastError () returned 0x12 [0223.582] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.582] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.583] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.584] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0223.584] GetLastError () returned 0x12 [0223.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.586] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.586] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0223.586] GetLastError () returned 0x12 [0223.586] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0223.586] GetLastError () returned 0x12 [0223.586] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0223.586] GetLastError () returned 0x12 [0223.587] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.587] GetLastError () returned 0x12 [0223.587] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.587] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.587] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.587] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0223.587] GetLastError () returned 0x12 [0223.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.589] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.589] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0223.589] GetLastError () returned 0x12 [0223.589] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0223.589] GetLastError () returned 0x12 [0223.589] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0223.589] GetLastError () returned 0x12 [0223.589] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.589] GetLastError () returned 0x12 [0223.589] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.589] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.590] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.590] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0223.590] GetLastError () returned 0x12 [0223.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.620] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.621] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.627] GetLastError () returned 0x12 [0223.628] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0223.629] GetLastError () returned 0x12 [0223.637] GetLastError () returned 0x12 [0223.637] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.638] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.639] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0223.639] GetLastError () returned 0x12 [0223.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.640] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.640] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0223.640] GetLastError () returned 0x12 [0223.640] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.641] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.641] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0223.641] GetLastError () returned 0x12 [0223.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.641] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.641] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0223.641] GetLastError () returned 0x12 [0223.642] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.642] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.642] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0223.642] GetLastError () returned 0x12 [0223.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.643] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.643] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0223.643] GetLastError () returned 0x12 [0223.643] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.644] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.644] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0223.644] GetLastError () returned 0x12 [0223.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.645] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.645] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0223.645] GetLastError () returned 0x12 [0223.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.645] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.646] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0223.646] GetLastError () returned 0x12 [0223.646] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.646] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x30aa908 | out: hHeap=0x290000) returned 1 [0223.646] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0223.646] GetLastError () returned 0x12 [0223.646] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.647] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.648] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0223.648] GetLastError () returned 0x12 [0223.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.766] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.766] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0223.766] GetLastError () returned 0x12 [0223.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.768] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.768] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0223.768] GetLastError () returned 0x12 [0223.768] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.769] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x30aa908 | out: hHeap=0x290000) returned 1 [0223.769] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0223.769] GetLastError () returned 0x12 [0223.769] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.769] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.770] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0223.770] GetLastError () returned 0x12 [0223.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.773] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.773] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0223.773] GetLastError () returned 0x12 [0223.773] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.774] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.774] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0223.774] GetLastError () returned 0x12 [0223.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.776] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.776] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0223.776] GetLastError () returned 0x12 [0223.776] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.777] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.777] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0223.777] GetLastError () returned 0x12 [0223.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.368] FindNextFileW (in: hFindFile=0x5a2e30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.368] FindNextFileW (in: hFindFile=0x5a2e30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0224.369] GetLastError () returned 0x12 [0224.369] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.369] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0224.369] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0224.370] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0224.370] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.373] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0224.373] FindClose (in: hFindFile=0x5a2bf0 | out: hFindFile=0x5a2bf0) returned 1 [0224.373] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0224.373] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0224.373] GetLastError () returned 0x12 [0224.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2bf0 [0224.374] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0224.374] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Admin", cAlternateFileName="")) returned 1 [0224.374] GetLastError () returned 0x12 [0224.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0224.374] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.374] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.374] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0224.374] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.374] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Admin", cAlternateFileName="")) returned 0 [0224.374] FindClose (in: hFindFile=0x5a2bf0 | out: hFindFile=0x5a2bf0) returned 1 [0224.374] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0224.374] FindNextFileW (in: hFindFile=0x5a2b70, lpFindFileData=0x31ffab8 | out: lpFindFileData=0x31ffab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc8df7a20, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xc8df7a20, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0224.375] GetLastError () returned 0x12 [0224.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc8df7a20, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xc8df7a20, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2bf0 [0224.375] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc8df7a20, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xc8df7a20, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0224.375] FindNextFileW (in: hFindFile=0x5a2bf0, lpFindFileData=0x31ff834 | out: lpFindFileData=0x31ff834*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0224.375] GetLastError () returned 0x12 [0224.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0224.375] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.375] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x31ff5b0 | out: lpFindFileData=0x31ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0224.375] GetLastError () returned 0x12 [0224.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.375] FindNextFileW (in: hFindFile=0x5a2e30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.375] FindNextFileW (in: hFindFile=0x5a2e30, lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0224.375] GetLastError () returned 0x12 [0224.375] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.375] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0224.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.376] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.376] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.376] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.376] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.377] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.377] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.377] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.377] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.377] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.377] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.378] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.379] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.379] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.379] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.463] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.463] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.464] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.464] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.464] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.464] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.464] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.464] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.464] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.464] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.465] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.465] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.466] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.472] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.472] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.472] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.472] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.472] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.472] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.472] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.473] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.473] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.473] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.473] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.474] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.474] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.475] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.475] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.475] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.476] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.476] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.476] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.476] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.476] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.476] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.476] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.476] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.477] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.477] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.477] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.477] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.477] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.477] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.477] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.477] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.477] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.478] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.478] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.478] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.478] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.478] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.478] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.479] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.479] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.479] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.479] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.479] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.479] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.479] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.479] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.480] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.480] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.480] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.480] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.480] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.480] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.480] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.481] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.481] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.481] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.481] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.481] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.481] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.481] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.481] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.482] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.482] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.482] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.482] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.482] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.482] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.482] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.482] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.483] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.483] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.483] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.483] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.483] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.483] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.483] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.484] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.484] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.484] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.484] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.485] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.485] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.486] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.486] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.486] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.486] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.487] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.488] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.488] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.488] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.491] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.492] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.492] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.492] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.492] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.492] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.493] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.493] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.494] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.494] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.494] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.495] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.495] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.495] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.495] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.495] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.495] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.495] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.496] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.496] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.496] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.496] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.496] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.496] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.496] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.496] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.497] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.497] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ff0 [0224.498] FindClose (in: hFindFile=0x5a2ff0 | out: hFindFile=0x5a2ff0) returned 1 [0224.498] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ff0 [0224.498] FindClose (in: hFindFile=0x5a2ff0 | out: hFindFile=0x5a2ff0) returned 1 [0224.498] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ff0 [0224.502] FindClose (in: hFindFile=0x5a2ff0 | out: hFindFile=0x5a2ff0) returned 1 [0224.502] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ff0 [0224.503] FindClose (in: hFindFile=0x5a2ff0 | out: hFindFile=0x5a2ff0) returned 1 [0224.503] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ff0 [0224.505] FindClose (in: hFindFile=0x5a2ff0 | out: hFindFile=0x5a2ff0) returned 1 [0224.505] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ff0 [0224.505] FindClose (in: hFindFile=0x5a2ff0 | out: hFindFile=0x5a2ff0) returned 1 [0224.505] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.506] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.506] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.506] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.506] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.507] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.507] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.510] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.511] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.514] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.517] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.603] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.603] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.605] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.605] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.605] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.605] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.606] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.606] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.606] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.606] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.607] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.608] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.608] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.609] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.609] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.609] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.612] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.612] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.612] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.612] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.613] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.613] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.613] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.613] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.613] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.613] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.613] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.614] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.614] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.614] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.614] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.614] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.614] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.614] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.615] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.615] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.615] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.615] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.615] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.615] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.615] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.615] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.616] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.616] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.617] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.617] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.618] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.618] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.618] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.618] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.619] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.619] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.620] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.620] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.621] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.621] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.622] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.622] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.623] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.623] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.624] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.624] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.627] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.627] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.628] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.628] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.630] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.630] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.630] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.630] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.631] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.631] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.632] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.632] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.633] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.633] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.633] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.633] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.634] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.634] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.635] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.635] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.635] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.635] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.636] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.636] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.636] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.636] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.637] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.637] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.638] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.638] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.639] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.639] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.640] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.640] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.642] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.642] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.654] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.655] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.655] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.655] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.657] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.657] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.657] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.657] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.657] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.657] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.660] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.660] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.661] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.661] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.661] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.661] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.662] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.662] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.662] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.663] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.663] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.663] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.664] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.664] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.665] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.665] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.666] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.666] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.670] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.670] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.671] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.671] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.671] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.671] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.672] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.672] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.672] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.672] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.675] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.676] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.677] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.677] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.681] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.681] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.681] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.681] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.682] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.682] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0224.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0227.454] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0227.454] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0228.155] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0228.155] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0228.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0228.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0228.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f70 [0228.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x31fe91c | out: lpFindFileData=0x31fe91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0228.156] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0228.156] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0231.092] FindClose (in: hFindFile=0x5a2f70 | out: hFindFile=0x5a2f70) returned 1 [0231.093] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0231.093] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0231.093] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0231.093] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0231.093] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0231.094] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0231.094] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0231.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0231.094] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0231.095] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0231.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0231.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0231.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0231.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x31feba0 | out: lpFindFileData=0x31feba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f70 [0231.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x31fe91c | out: lpFindFileData=0x31fe91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0231.096] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0231.096] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0234.052] FindClose (in: hFindFile=0x5a2f70 | out: hFindFile=0x5a2f70) returned 1 [0234.052] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0236.630] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0236.630] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0236.631] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0236.631] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0236.632] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0236.632] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x303a8d0 | out: hHeap=0x290000) returned 1 [0236.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x31ff32c | out: lpFindFileData=0x31ff32c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0236.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0236.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0236.985] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0236.985] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0241.919] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0241.919] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0241.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0241.920] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0241.920] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x304a8d8 | out: hHeap=0x290000) returned 1 [0241.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x31ff0a8 | out: lpFindFileData=0x31ff0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0241.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x31fee24 | out: lpFindFileData=0x31fee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 Thread: id = 99 os_tid = 0x8fc [0223.462] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x38) returned 0x296288 [0223.462] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x18) returned 0x297eb0 [0223.462] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2ec [0223.462] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2f0 [0223.462] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2f4 [0223.462] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x301a8c0 [0223.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x403a08, lpParameter=0x32bfd78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0223.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x403a08, lpParameter=0x32bfd78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0223.492] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x305a8e0 [0223.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x32bfaec | out: lpFindFileData=0x32bfaec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5a2c30 [0223.493] GetLastError () returned 0x0 [0223.493] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x214) returned 0x29dc78 [0223.493] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0223.493] GetCurrentThreadId () returned 0x8fc [0223.493] SetLastError (dwErrCode=0x0) [0223.493] GetLastError () returned 0x0 [0223.493] SetLastError (dwErrCode=0x0) [0223.493] GetLastError () returned 0x0 [0223.493] SetLastError (dwErrCode=0x0) [0223.493] GetLastError () returned 0x0 [0223.493] SetLastError (dwErrCode=0x0) [0223.493] GetLastError () returned 0x0 [0223.493] SetLastError (dwErrCode=0x0) [0223.493] GetLastError () returned 0x0 [0223.494] SetLastError (dwErrCode=0x0) [0223.494] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x306a8e8 [0223.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2c70 [0223.494] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0223.494] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0223.494] GetLastError () returned 0x0 [0223.494] SetLastError (dwErrCode=0x0) [0223.494] GetLastError () returned 0x0 [0223.494] SetLastError (dwErrCode=0x0) [0223.494] GetLastError () returned 0x0 [0223.494] SetLastError (dwErrCode=0x0) [0223.494] GetLastError () returned 0x0 [0223.495] SetLastError (dwErrCode=0x0) [0223.495] GetLastError () returned 0x0 [0223.495] SetLastError (dwErrCode=0x0) [0223.495] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x307a8f0 [0223.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.496] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.496] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0223.496] GetLastError () returned 0x0 [0223.496] SetLastError (dwErrCode=0x0) [0223.496] GetLastError () returned 0x0 [0223.496] SetLastError (dwErrCode=0x0) [0223.496] GetLastError () returned 0x0 [0223.496] SetLastError (dwErrCode=0x0) [0223.496] GetLastError () returned 0x0 [0223.496] SetLastError (dwErrCode=0x0) [0223.496] GetLastError () returned 0x0 [0223.496] SetLastError (dwErrCode=0x0) [0223.496] GetLastError () returned 0x0 [0223.496] SetLastError (dwErrCode=0x0) [0223.496] GetLastError () returned 0x0 [0223.496] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.497] GetLastError () returned 0x0 [0223.497] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.498] GetLastError () returned 0x0 [0223.498] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.499] GetLastError () returned 0x0 [0223.499] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.500] SetLastError (dwErrCode=0x0) [0223.500] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.501] SetLastError (dwErrCode=0x0) [0223.501] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.502] SetLastError (dwErrCode=0x0) [0223.502] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.503] SetLastError (dwErrCode=0x0) [0223.503] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.504] SetLastError (dwErrCode=0x0) [0223.504] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.505] SetLastError (dwErrCode=0x0) [0223.505] GetLastError () returned 0x0 [0223.506] SetLastError (dwErrCode=0x0) [0223.506] GetLastError () returned 0x0 [0223.506] SetLastError (dwErrCode=0x0) [0223.506] GetLastError () returned 0x0 [0223.506] SetLastError (dwErrCode=0x0) [0223.506] GetLastError () returned 0x0 [0223.506] SetLastError (dwErrCode=0x0) [0223.506] GetLastError () returned 0x0 [0223.506] SetLastError (dwErrCode=0x0) [0223.506] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.507] SetLastError (dwErrCode=0x0) [0223.507] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.508] SetLastError (dwErrCode=0x0) [0223.508] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.509] GetLastError () returned 0x0 [0223.509] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.510] SetLastError (dwErrCode=0x0) [0223.510] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.511] SetLastError (dwErrCode=0x0) [0223.511] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.512] SetLastError (dwErrCode=0x0) [0223.512] GetLastError () returned 0x0 [0223.513] SetLastError (dwErrCode=0x0) [0223.513] GetLastError () returned 0x0 [0223.513] SetLastError (dwErrCode=0x0) [0223.513] GetLastError () returned 0x0 [0223.513] SetLastError (dwErrCode=0x0) [0223.513] GetLastError () returned 0x0 [0223.513] SetLastError (dwErrCode=0x0) [0223.513] GetLastError () returned 0x0 [0223.513] SetLastError (dwErrCode=0x0) [0223.513] GetLastError () returned 0x0 [0223.513] SetLastError (dwErrCode=0x0) [0223.513] GetLastError () returned 0x0 [0223.513] SetLastError (dwErrCode=0x0) [0223.513] GetLastError () returned 0x0 [0223.513] SetLastError (dwErrCode=0x0) [0223.513] SetEvent (hEvent=0x2f0) returned 1 [0223.513] ResetEvent (hEvent=0x2f4) returned 1 [0223.513] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0223.513] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.514] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.514] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0223.514] FindClose (in: hFindFile=0x5a2c70 | out: hFindFile=0x5a2c70) returned 1 [0223.514] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x306a8e8 | out: hHeap=0x290000) returned 1 [0223.514] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x32bfaec | out: lpFindFileData=0x32bfaec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0223.514] GetLastError () returned 0x12 [0223.514] SetLastError (dwErrCode=0x12) [0223.514] GetLastError () returned 0x12 [0223.515] SetLastError (dwErrCode=0x12) [0223.515] GetLastError () returned 0x12 [0223.515] SetLastError (dwErrCode=0x12) [0223.515] GetLastError () returned 0x12 [0223.515] SetLastError (dwErrCode=0x12) [0223.515] GetLastError () returned 0x12 [0223.515] SetLastError (dwErrCode=0x12) [0223.515] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x306a8e8 [0223.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2c70 [0223.515] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD", cAlternateFileName="")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0223.515] GetLastError () returned 0x12 [0223.515] SetLastError (dwErrCode=0x12) [0223.515] GetLastError () returned 0x12 [0223.515] SetLastError (dwErrCode=0x12) [0223.515] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.516] SetLastError (dwErrCode=0x12) [0223.516] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.517] SetLastError (dwErrCode=0x12) [0223.517] GetLastError () returned 0x12 [0223.518] SetLastError (dwErrCode=0x12) [0223.518] GetLastError () returned 0x12 [0223.518] SetLastError (dwErrCode=0x12) [0223.518] GetLastError () returned 0x12 [0223.518] SetLastError (dwErrCode=0x12) [0223.518] GetLastError () returned 0x12 [0223.518] SetLastError (dwErrCode=0x12) [0223.518] GetLastError () returned 0x12 [0223.518] SetLastError (dwErrCode=0x12) [0223.518] GetLastError () returned 0x12 [0223.518] SetLastError (dwErrCode=0x12) [0223.518] GetLastError () returned 0x12 [0223.518] SetLastError (dwErrCode=0x12) [0223.518] GetLastError () returned 0x12 [0223.518] SetLastError (dwErrCode=0x12) [0223.518] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0223.518] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0223.518] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0223.519] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0223.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.519] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.519] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.519] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.519] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.519] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.519] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="da-DK", cAlternateFileName="")) returned 1 [0223.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.520] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.520] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.520] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.520] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.520] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.520] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="de-DE", cAlternateFileName="")) returned 1 [0223.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.521] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.521] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.521] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.521] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.521] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.521] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="el-GR", cAlternateFileName="")) returned 1 [0223.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.521] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.521] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.522] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.522] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.522] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.522] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="en-US", cAlternateFileName="")) returned 1 [0223.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.523] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.523] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.523] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.523] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.523] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.523] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.523] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="es-ES", cAlternateFileName="")) returned 1 [0223.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.524] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.524] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.524] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.524] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.524] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.524] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0223.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.524] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.524] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.524] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.525] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.525] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.525] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Fonts", cAlternateFileName="")) returned 1 [0223.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.526] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.526] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0223.526] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0223.526] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0223.526] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0223.526] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0223.526] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0223.526] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.526] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.526] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0223.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.527] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.527] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.528] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.528] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.528] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.528] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0223.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.528] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.528] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.528] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.528] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.529] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.529] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="it-IT", cAlternateFileName="")) returned 1 [0223.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.529] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.529] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.529] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.530] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.530] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.530] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0223.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.530] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.530] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.530] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.530] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.530] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.530] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0223.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.531] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.531] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.531] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.531] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.531] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.531] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x44, dwReserved1=0x44, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0223.532] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0223.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.532] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.532] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.532] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.532] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.532] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.532] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0223.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.534] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.534] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.534] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.534] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.534] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.534] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0223.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.535] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.535] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.535] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.535] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.535] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.535] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0223.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.536] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.536] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.536] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.536] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.536] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.536] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0223.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.536] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.536] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.537] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.537] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.537] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.537] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0223.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.538] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.538] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.538] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0223.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0223.538] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x5a2cf0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.538] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0223.538] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0223.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.558] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.559] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.561] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.564] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.564] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x307a8f0 | out: hHeap=0x290000) returned 1 [0223.569] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0223.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.586] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.589] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.591] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.591] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.591] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x308a8f8 | out: hHeap=0x290000) returned 1 [0223.591] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0223.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.592] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.592] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.592] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.592] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.592] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x308a8f8 | out: hHeap=0x290000) returned 1 [0223.592] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0223.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.592] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.592] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.593] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.593] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0223.593] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x308a8f8 | out: hHeap=0x290000) returned 1 [0223.593] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0223.593] FindClose (in: hFindFile=0x5a2c70 | out: hFindFile=0x5a2c70) returned 1 [0223.593] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x306a8e8 | out: hHeap=0x290000) returned 1 [0223.594] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x32bfaec | out: lpFindFileData=0x32bfaec*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0223.594] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x32bfaec | out: lpFindFileData=0x32bfaec*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0223.594] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x32bfaec | out: lpFindFileData=0x32bfaec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0223.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2c70 [0223.594] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0223.594] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 0 [0223.594] FindClose (in: hFindFile=0x5a2c70 | out: hFindFile=0x5a2c70) returned 1 [0223.594] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x306a8e8 | out: hHeap=0x290000) returned 1 [0223.594] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x32bfaec | out: lpFindFileData=0x32bfaec*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0223.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="\xfd78\x32b\xa8e0\x305\x5c\x5c\x3f\x5c\xa8ee\x305\xfac8\x32b\x39c8\x40\x08\x01\xa8e8\x305")) returned 0xffffffff [0223.595] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x306a8e8 | out: hHeap=0x290000) returned 1 [0223.595] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x32bfaec | out: lpFindFileData=0x32bfaec*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0223.595] FindNextFileW (in: hFindFile=0x5a2c30, lpFindFileData=0x32bfaec | out: lpFindFileData=0x32bfaec*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0223.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2c70 [0223.595] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0223.595] FindNextFileW (in: hFindFile=0x5a2c70, lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0223.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0223.597] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.597] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0223.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.597] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.597] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0223.597] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0223.597] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0223.597] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.597] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.598] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.598] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.598] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0223.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.598] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.599] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0223.599] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0223.599] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0223.599] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.599] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.599] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.600] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.600] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0223.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.601] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.601] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0223.601] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0223.601] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0223.601] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.601] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.601] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.603] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.603] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0223.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.604] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.604] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0223.604] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0223.604] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0223.604] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.605] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.605] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.605] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.606] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0223.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.606] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.606] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.606] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0223.606] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0223.606] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0223.606] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0223.607] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.607] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.607] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0223.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.608] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.608] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0223.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.608] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.609] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0223.609] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0223.609] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0223.609] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0223.609] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.609] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x30aa908 | out: hHeap=0x290000) returned 1 [0223.609] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0223.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.609] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.610] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0223.610] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0223.610] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0223.610] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0223.610] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.610] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x30aa908 | out: hHeap=0x290000) returned 1 [0223.610] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0223.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.610] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.610] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0223.611] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0223.611] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0223.611] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0223.611] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.611] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x30aa908 | out: hHeap=0x290000) returned 1 [0223.611] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0223.611] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0223.611] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.611] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.612] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.612] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.612] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0223.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.614] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.614] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0223.614] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0223.614] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0223.614] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.614] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.614] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.615] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.615] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0223.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.616] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.616] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0223.617] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0223.617] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0223.617] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.617] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.617] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.618] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.618] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0223.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.618] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.618] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.619] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0223.619] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0223.619] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0223.619] FindNextFileW (in: hFindFile=0x5a2d30, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0223.619] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.619] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.619] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0223.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.621] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.622] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0223.622] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0223.622] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0223.622] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.622] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.622] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.623] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.623] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0223.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.626] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.626] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0223.626] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0223.626] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0223.626] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.626] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.626] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.627] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.627] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0223.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.630] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.630] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0223.630] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0223.630] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0223.630] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.630] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0223.630] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.631] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.631] FindNextFileW (in: hFindFile=0x5a2cb0, lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0223.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.633] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.633] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0223.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0223.634] FindNextFileW (in: hFindFile=0x5a2db0, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.634] FindNextFileW (in: hFindFile=0x5a2db0, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0223.634] FindNextFileW (in: hFindFile=0x5a2db0, lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0223.634] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0223.635] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x30aa908 | out: hHeap=0x290000) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0223.635] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0223.636] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0223.636] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0223.636] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0223.636] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0223.636] FindNextFileW (in: hFindFile=0x5a2d70, lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0223.636] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.637] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0223.779] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0223.779] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x30aa908 | out: hHeap=0x290000) returned 1 [0223.779] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.780] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.780] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.781] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0223.782] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0223.783] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0223.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0224.165] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0224.165] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0224.165] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0224.165] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x308a8f8 | out: hHeap=0x290000) returned 1 [0224.165] FindClose (in: hFindFile=0x5a2c70 | out: hFindFile=0x5a2c70) returned 1 [0224.165] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x306a8e8 | out: hHeap=0x290000) returned 1 [0224.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2c70 [0224.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0224.167] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0224.167] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x308a8f8 | out: hHeap=0x290000) returned 1 [0224.167] FindClose (in: hFindFile=0x5a2c70 | out: hFindFile=0x5a2c70) returned 1 [0224.167] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x306a8e8 | out: hHeap=0x290000) returned 1 [0224.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x32bf868 | out: lpFindFileData=0x32bf868*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc8df7a20, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xc8df7a20, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5a2c70 [0224.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0224.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0224.169] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0224.169] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0224.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0224.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.181] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.181] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.211] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.211] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.211] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.211] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.300] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.300] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.301] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.301] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.303] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.304] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.305] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.305] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.306] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.306] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.307] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.307] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.307] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.307] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.308] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.308] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.309] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.309] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.309] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.309] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.311] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.312] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.312] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.312] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.314] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.314] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.314] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.314] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.315] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.315] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.318] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.318] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.318] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.318] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.320] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.320] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.321] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.321] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.321] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.321] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.322] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.324] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.324] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.324] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.324] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.324] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.326] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.326] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3690080 | out: hHeap=0x290000) returned 1 [0224.326] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.326] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.326] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.327] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.327] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.327] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.327] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.327] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.328] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.328] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.330] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.330] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.331] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.331] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e30 [0224.331] FindClose (in: hFindFile=0x5a2e30 | out: hFindFile=0x5a2e30) returned 1 [0224.331] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cf0 [0224.371] FindClose (in: hFindFile=0x5a2cf0 | out: hFindFile=0x5a2cf0) returned 1 [0224.371] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.380] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.380] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.380] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.381] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.381] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.381] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.382] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.382] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.382] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.382] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.384] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.384] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.385] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.385] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.386] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.386] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.386] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.386] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.387] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.387] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.387] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.387] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.390] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.390] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.390] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.391] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.391] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.391] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.391] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.392] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.392] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.393] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.393] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.393] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.393] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.393] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.394] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.394] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.395] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.395] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.395] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.395] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.403] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.404] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.404] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.404] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.424] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.424] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.425] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.425] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.427] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.427] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.427] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.428] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.429] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.430] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.431] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.431] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.431] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.432] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.432] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.432] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0224.433] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0224.434] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.440] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.441] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.441] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.441] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.442] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.442] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.443] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.443] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.503] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.506] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.520] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.520] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.520] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.520] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.521] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.521] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.521] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.521] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.521] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.521] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.521] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.521] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.522] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.522] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.522] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.522] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.523] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.523] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.524] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.525] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.525] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.525] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.575] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.575] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.577] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.577] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.577] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.577] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0224.578] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.579] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.580] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.580] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.585] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.586] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.587] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.587] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.587] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.588] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.592] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.592] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.593] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.593] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.594] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.594] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.595] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.595] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.595] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.595] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.596] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.596] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.597] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.597] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.598] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.598] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.598] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.599] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.599] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.599] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.600] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.600] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.601] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.601] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.602] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.602] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.622] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.622] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.637] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.640] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.643] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.643] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.643] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.643] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.644] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.644] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.644] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.644] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.644] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.644] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.644] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.644] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.645] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.645] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.645] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.645] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.645] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.645] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.645] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.646] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.646] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.646] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.646] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.646] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.646] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.646] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.646] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.647] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.647] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.647] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.647] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.647] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.647] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.647] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.648] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.648] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.648] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.648] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.648] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.648] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.648] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.648] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.649] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.649] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.649] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.649] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.649] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.649] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.649] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.650] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.650] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.650] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.650] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.650] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0224.659] FindClose (in: hFindFile=0x5a2db0 | out: hFindFile=0x5a2db0) returned 1 [0224.664] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f30 [0224.669] FindClose (in: hFindFile=0x5a2f30 | out: hFindFile=0x5a2f30) returned 1 [0224.673] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.677] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.684] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.684] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.684] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.686] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.686] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.686] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.686] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.687] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.687] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.687] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.687] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.687] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.687] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.687] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.687] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.688] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.688] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.690] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.690] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.690] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.690] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.693] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.693] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.693] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.693] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.693] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.694] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.695] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.695] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.695] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.695] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.697] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.697] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.697] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.698] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.700] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.700] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.700] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.700] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.700] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.700] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.702] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.702] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.702] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.702] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0224.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0224.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0224.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x32be950 | out: lpFindFileData=0x32be950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ff0 [0224.732] FindClose (in: hFindFile=0x5a2ff0 | out: hFindFile=0x5a2ff0) returned 1 [0224.732] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0224.732] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0224.733] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0224.733] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0224.733] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0224.733] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0224.733] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0224.734] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0224.734] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0224.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0224.734] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0224.734] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0224.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0224.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0226.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0226.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x32bebd4 | out: lpFindFileData=0x32bebd4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2fb0 [0226.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x32be950 | out: lpFindFileData=0x32be950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ff0 [0226.210] FindClose (in: hFindFile=0x5a2ff0 | out: hFindFile=0x5a2ff0) returned 1 [0226.211] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36c0098 | out: hHeap=0x290000) returned 1 [0226.211] FindClose (in: hFindFile=0x5a2fb0 | out: hFindFile=0x5a2fb0) returned 1 [0226.211] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36b0090 | out: hHeap=0x290000) returned 1 [0226.211] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0226.211] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0226.211] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0226.211] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0226.212] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0226.212] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0226.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0226.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0226.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e70 [0226.750] FindClose (in: hFindFile=0x5a2e70 | out: hFindFile=0x5a2e70) returned 1 [0226.750] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0226.750] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0226.750] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0226.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0226.752] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0226.752] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0226.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0226.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2f70 [0227.046] FindClose (in: hFindFile=0x5a2f70 | out: hFindFile=0x5a2f70) returned 1 [0227.047] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0227.047] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0227.047] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0227.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df0 [0227.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0227.150] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0227.150] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0227.150] FindClose (in: hFindFile=0x5a2df0 | out: hFindFile=0x5a2df0) returned 1 [0227.150] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0227.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df0 [0227.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0227.346] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0227.346] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x36a0088 | out: hHeap=0x290000) returned 1 [0227.346] FindClose (in: hFindFile=0x5a2df0 | out: hFindFile=0x5a2df0) returned 1 [0227.346] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3670070 | out: hHeap=0x290000) returned 1 [0227.347] FindClose (in: hFindFile=0x5a2d70 | out: hFindFile=0x5a2d70) returned 1 [0227.347] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0227.347] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0227.347] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x308a8f8 | out: hHeap=0x290000) returned 1 [0227.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x32bf5e4 | out: lpFindFileData=0x32bf5e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc141f400, ftLastAccessTime.dwHighDateTime=0x1d52863, ftLastWriteTime.dwLowDateTime=0xc141f400, ftLastWriteTime.dwHighDateTime=0x1d52863, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db0 [0227.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0227.673] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0227.673] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x3680078 | out: hHeap=0x290000) returned 1 [0227.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x32bf360 | out: lpFindFileData=0x32bf360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d70 [0227.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x32bf0dc | out: lpFindFileData=0x32bf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df0 [0227.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d30 [0227.843] FindClose (in: hFindFile=0x5a2d30 | out: hFindFile=0x5a2d30) returned 1 [0227.843] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0227.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0227.847] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0227.848] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0227.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0227.855] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0227.856] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0227.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0227.858] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0227.859] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0228.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0229.627] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0229.628] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0229.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0231.039] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0231.040] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0231.042] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0231.044] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0231.045] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0231.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0231.046] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0231.047] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0231.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0231.200] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0231.206] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0231.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0233.127] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0233.128] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0233.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0233.967] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0233.967] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0233.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0234.120] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0234.121] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0234.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 [0236.314] FindClose (in: hFindFile=0x5a2cb0 | out: hFindFile=0x5a2cb0) returned 1 [0236.315] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0236.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0236.561] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0236.561] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0236.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0236.698] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0236.699] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0236.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0238.071] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0238.071] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0238.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2ef0 [0238.980] FindClose (in: hFindFile=0x5a2ef0 | out: hFindFile=0x5a2ef0) returned 1 [0238.981] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0238.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0241.964] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0241.965] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0241.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2eb0 [0241.979] FindClose (in: hFindFile=0x5a2eb0 | out: hFindFile=0x5a2eb0) returned 1 [0241.979] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x309a900 | out: hHeap=0x290000) returned 1 [0241.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x32bee58 | out: lpFindFileData=0x32bee58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2cb0 Thread: id = 100 os_tid = 0x8e0 [0223.787] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x30aa908 [0223.787] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x30ba910 [0223.788] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x297ed0 [0223.788] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x110102) returned 0x3500020 [0223.788] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x50) returned 0x297f00 [0223.788] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfdd8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfe40 | out: phKey=0x33dfe40*=0x5a2d30) returned 1 [0223.788] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x33dfe28, dwFlags=0x0) returned 1 [0223.788] CryptDecrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f00, pdwDataLen=0x33dfdf4 | out: pbData=0x297f00, pdwDataLen=0x33dfdf4) returned 1 [0223.788] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0223.789] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0223.789] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0223.789] Wow64DisableWow64FsRedirection (in: OldValue=0x33dfe90 | out: OldValue=0x33dfe90*=0x0) returned 1 [0223.789] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f00 | out: hHeap=0x290000) returned 1 [0223.789] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.789] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.789] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.789] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.790] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=0) returned 1 [0223.790] CloseHandle (hObject=0x32c) returned 1 [0223.790] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.790] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.790] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=0) returned 1 [0223.790] CloseHandle (hObject=0x32c) returned 1 [0223.790] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.790] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.790] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=89168) returned 1 [0223.790] CloseHandle (hObject=0x32c) returned 1 [0223.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0223.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0223.791] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.791] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.791] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.791] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=87616) returned 1 [0223.791] CloseHandle (hObject=0x32c) returned 1 [0223.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0223.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0223.791] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.792] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.792] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.792] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=91712) returned 1 [0223.792] CloseHandle (hObject=0x32c) returned 1 [0223.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0223.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0223.792] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.792] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.792] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.792] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=94800) returned 1 [0223.792] CloseHandle (hObject=0x32c) returned 1 [0223.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0223.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0223.793] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.793] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.793] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.793] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=85056) returned 1 [0223.793] CloseHandle (hObject=0x32c) returned 1 [0223.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0223.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0223.793] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.794] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.794] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.794] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=43600) returned 1 [0223.794] CloseHandle (hObject=0x32c) returned 1 [0223.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0223.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0223.794] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.794] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.794] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.794] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=90192) returned 1 [0223.794] CloseHandle (hObject=0x32c) returned 1 [0223.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0223.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0223.795] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.795] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.795] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.795] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=89152) returned 1 [0223.795] CloseHandle (hObject=0x32c) returned 1 [0223.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0223.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0223.795] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.795] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.796] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0223.796] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=3694080) returned 1 [0223.796] CloseHandle (hObject=0x32c) returned 1 [0223.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0223.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0223.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0223.796] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0223.796] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.143] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=3876772) returned 1 [0224.143] CloseHandle (hObject=0x330) returned 1 [0224.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0224.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0224.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0224.144] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.144] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.144] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=2371360) returned 1 [0224.144] CloseHandle (hObject=0x330) returned 1 [0224.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0224.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0224.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0224.149] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.149] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.149] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=47452) returned 1 [0224.149] CloseHandle (hObject=0x330) returned 1 [0224.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0224.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.149] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.149] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.149] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.150] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=93248) returned 1 [0224.150] CloseHandle (hObject=0x330) returned 1 [0224.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0224.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.150] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.150] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.150] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.150] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=90688) returned 1 [0224.150] CloseHandle (hObject=0x330) returned 1 [0224.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0224.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.150] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.151] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.151] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.151] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=90704) returned 1 [0224.151] CloseHandle (hObject=0x330) returned 1 [0224.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0224.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.151] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.151] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.151] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.151] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=76352) returned 1 [0224.151] CloseHandle (hObject=0x330) returned 1 [0224.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0224.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.152] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.152] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.152] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.152] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=75344) returned 1 [0224.152] CloseHandle (hObject=0x330) returned 1 [0224.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0224.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.152] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.152] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.152] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.153] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=485760) returned 1 [0224.153] CloseHandle (hObject=0x330) returned 1 [0224.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0224.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.153] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.153] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.153] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.153] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=88144) returned 1 [0224.154] CloseHandle (hObject=0x330) returned 1 [0224.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0224.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.154] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.155] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.156] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.156] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=90704) returned 1 [0224.156] CloseHandle (hObject=0x330) returned 1 [0224.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0224.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.156] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.156] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.156] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.156] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=90704) returned 1 [0224.156] CloseHandle (hObject=0x330) returned 1 [0224.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0224.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.157] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.157] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.157] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.157] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=90176) returned 1 [0224.157] CloseHandle (hObject=0x330) returned 1 [0224.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0224.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.157] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.157] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.157] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.158] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=89664) returned 1 [0224.158] CloseHandle (hObject=0x330) returned 1 [0224.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0224.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.158] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.158] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.158] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.158] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=90192) returned 1 [0224.158] CloseHandle (hObject=0x330) returned 1 [0224.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0224.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.158] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.159] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.159] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.159] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=87616) returned 1 [0224.159] CloseHandle (hObject=0x330) returned 1 [0224.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0224.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.159] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.159] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.159] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.159] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=87104) returned 1 [0224.159] CloseHandle (hObject=0x330) returned 1 [0224.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0224.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.160] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.160] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.160] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.160] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=70720) returned 1 [0224.160] CloseHandle (hObject=0x330) returned 1 [0224.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0224.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.160] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.160] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.161] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.161] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=70224) returned 1 [0224.161] CloseHandle (hObject=0x330) returned 1 [0224.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0224.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.161] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.161] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.161] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.162] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=70208) returned 1 [0224.162] CloseHandle (hObject=0x330) returned 1 [0224.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0224.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.162] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.162] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.162] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0224.162] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=383786) returned 1 [0224.162] CloseHandle (hObject=0x330) returned 1 [0224.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0224.162] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0224.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\bootmgr.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.163] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.163] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0224.163] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.163] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.163] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0224.163] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0224.191] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=16972987) returned 1 [0224.191] CloseHandle (hObject=0x348) returned 1 [0224.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0224.191] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0224.196] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0224.196] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0224.196] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0224.196] ReadFile (in: hFile=0x348, lpBuffer=0x3500058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3500058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0224.204] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0224.204] ReadFile (in: hFile=0x348, lpBuffer=0x3540058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3540058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0224.297] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0224.297] ReadFile (in: hFile=0x348, lpBuffer=0x3580058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3580058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0224.439] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfdfc | out: phKey=0x33dfdfc*=0x5a2ef0) returned 1 [0224.439] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0224.439] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050) returned 1 [0226.912] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0226.912] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd8 | out: lpNewFilePointer=0x0) returned 1 [0226.912] WriteFile (in: hFile=0x348, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33dfde8, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfde8*=0xc0102, lpOverlapped=0x0) returned 1 [0226.929] SetEndOfFile (hFile=0x348) returned 1 [0226.933] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0226.933] WriteFile (in: hFile=0x348, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0226.935] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0226.935] WriteFile (in: hFile=0x348, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0226.936] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0226.936] WriteFile (in: hFile=0x348, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0226.937] CloseHandle (hObject=0x348) returned 1 [0228.149] SetEvent (hEvent=0x2d4) returned 1 [0228.176] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0228.176] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.620] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=70361744) returned 1 [0229.620] CloseHandle (hObject=0x390) returned 1 [0229.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0229.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0229.630] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.630] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0229.630] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0229.630] ReadFile (in: hFile=0x390, lpBuffer=0x3500058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3500058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0229.634] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0229.634] ReadFile (in: hFile=0x390, lpBuffer=0x3540058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3540058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0229.640] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0229.640] ReadFile (in: hFile=0x390, lpBuffer=0x3580058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3580058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0229.647] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfdfc | out: phKey=0x33dfdfc*=0x5a2fb0) returned 1 [0229.647] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0229.648] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050) returned 1 [0229.654] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.655] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd8 | out: lpNewFilePointer=0x0) returned 1 [0229.655] WriteFile (in: hFile=0x390, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33dfde8, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfde8*=0xc0102, lpOverlapped=0x0) returned 1 [0230.407] SetEndOfFile (hFile=0x390) returned 1 [0230.407] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0230.407] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0230.409] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0230.409] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0230.410] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0230.410] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0230.410] CloseHandle (hObject=0x390) returned 1 [0231.870] SetEvent (hEvent=0x2d4) returned 1 [0231.870] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0231.870] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0231.870] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=14819276) returned 1 [0231.870] CloseHandle (hObject=0x390) returned 1 [0231.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0231.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0231.871] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0231.871] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0231.871] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0231.871] ReadFile (in: hFile=0x390, lpBuffer=0x3500058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3500058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0233.059] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0233.059] ReadFile (in: hFile=0x390, lpBuffer=0x3540058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3540058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0233.062] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0233.062] ReadFile (in: hFile=0x390, lpBuffer=0x3580058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3580058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0233.072] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfdfc | out: phKey=0x33dfdfc*=0x5a2e70) returned 1 [0233.072] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0233.073] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050) returned 1 [0233.079] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.079] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd8 | out: lpNewFilePointer=0x0) returned 1 [0233.079] WriteFile (in: hFile=0x390, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33dfde8, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfde8*=0xc0102, lpOverlapped=0x0) returned 1 [0233.571] SetEndOfFile (hFile=0x390) returned 1 [0233.571] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0233.571] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0233.573] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0233.573] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0233.574] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0233.574] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0233.574] CloseHandle (hObject=0x390) returned 1 [0234.672] SetEvent (hEvent=0x2d4) returned 1 [0234.676] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0234.676] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0234.676] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=2522624) returned 1 [0234.676] CloseHandle (hObject=0x390) returned 1 [0234.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0234.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0234.677] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0234.677] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0234.677] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0234.677] ReadFile (in: hFile=0x390, lpBuffer=0x3500058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3500058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0234.679] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0234.679] ReadFile (in: hFile=0x390, lpBuffer=0x3540058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3540058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0234.784] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0234.784] ReadFile (in: hFile=0x390, lpBuffer=0x3580058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3580058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0235.889] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfdfc | out: phKey=0x33dfdfc*=0x5a2e70) returned 1 [0235.889] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0235.889] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050) returned 1 [0235.896] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0235.896] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd8 | out: lpNewFilePointer=0x0) returned 1 [0235.896] WriteFile (in: hFile=0x390, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33dfde8, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfde8*=0xc0102, lpOverlapped=0x0) returned 1 [0235.912] SetEndOfFile (hFile=0x390) returned 1 [0235.912] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0235.912] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0235.914] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0235.914] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0235.918] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0235.918] WriteFile (in: hFile=0x390, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0235.920] CloseHandle (hObject=0x390) returned 1 [0236.630] SetEvent (hEvent=0x2d4) returned 1 [0236.633] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0236.633] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0236.634] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=11482605) returned 1 [0236.634] CloseHandle (hObject=0x348) returned 1 [0236.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0236.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0236.778] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0236.778] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0236.778] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0236.778] ReadFile (in: hFile=0x348, lpBuffer=0x3500058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3500058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0236.784] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0236.784] ReadFile (in: hFile=0x348, lpBuffer=0x3540058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3540058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0236.866] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0236.867] ReadFile (in: hFile=0x348, lpBuffer=0x3580058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3580058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0236.886] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfdfc | out: phKey=0x33dfdfc*=0x5a2cb0) returned 1 [0236.886] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0236.887] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050) returned 1 [0236.894] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0236.894] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd8 | out: lpNewFilePointer=0x0) returned 1 [0236.894] WriteFile (in: hFile=0x348, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33dfde8, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfde8*=0xc0102, lpOverlapped=0x0) returned 1 [0236.911] SetEndOfFile (hFile=0x348) returned 1 [0236.911] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0236.911] WriteFile (in: hFile=0x348, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0236.914] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0236.914] WriteFile (in: hFile=0x348, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0236.918] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0236.918] WriteFile (in: hFile=0x348, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0236.919] CloseHandle (hObject=0x348) returned 1 [0238.406] SetEvent (hEvent=0x2d4) returned 1 [0238.407] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0238.407] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0238.407] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=881152) returned 1 [0238.407] CloseHandle (hObject=0x348) returned 1 [0238.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0238.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.407] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0238.407] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd0 | out: lpNewFilePointer=0x0) returned 1 [0238.407] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd0 | out: lpNewFilePointer=0x0) returned 1 [0238.407] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0238.408] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd88, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfde4 | out: phKey=0x33dfde4*=0x5a2cb0) returned 1 [0238.408] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0238.408] ReadFile (in: hFile=0x348, lpBuffer=0x3500020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x33dfe0c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x33dfe0c*=0xd7200, lpOverlapped=0x0) returned 1 [0238.442] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfda8*=0xd7210, dwBufLen=0xd7210 | out: pbData=0x3500020*, pdwDataLen=0x33dfda8*=0xd7210) returned 1 [0238.450] WriteFile (in: hFile=0x370, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x33dfdf0, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfdf0*=0xd7210, lpOverlapped=0x0) returned 1 [0238.465] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfde8 | out: phKey=0x33dfde8*=0x5a2f70) returned 1 [0238.465] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0238.465] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfda8*=0x40, dwBufLen=0x40 | out: pbData=0x3500020*, pdwDataLen=0x33dfda8*=0x40) returned 1 [0238.465] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.465] WriteFile (in: hFile=0x370, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33dfdf0, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfdf0*=0xf2, lpOverlapped=0x0) returned 1 [0238.465] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.465] CloseHandle (hObject=0x348) returned 1 [0238.465] CloseHandle (hObject=0x370) returned 1 [0238.525] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0238.533] SetEvent (hEvent=0x2d4) returned 1 [0238.533] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0238.533] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0238.533] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=21064532) returned 1 [0238.533] CloseHandle (hObject=0x370) returned 1 [0238.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0238.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0238.627] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0238.627] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0238.627] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0238.627] ReadFile (in: hFile=0x370, lpBuffer=0x3500058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3500058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0238.643] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0238.643] ReadFile (in: hFile=0x370, lpBuffer=0x3540058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3540058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0238.663] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0238.663] ReadFile (in: hFile=0x370, lpBuffer=0x3580058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3580058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0238.675] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfdfc | out: phKey=0x33dfdfc*=0x5a2eb0) returned 1 [0238.675] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0238.675] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050) returned 1 [0238.823] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.823] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd8 | out: lpNewFilePointer=0x0) returned 1 [0238.823] WriteFile (in: hFile=0x370, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33dfde8, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfde8*=0xc0102, lpOverlapped=0x0) returned 1 [0238.841] SetEndOfFile (hFile=0x370) returned 1 [0238.841] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0238.841] WriteFile (in: hFile=0x370, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0238.843] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0238.843] WriteFile (in: hFile=0x370, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0238.844] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0238.844] WriteFile (in: hFile=0x370, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0238.845] CloseHandle (hObject=0x370) returned 1 [0241.289] SetEvent (hEvent=0x2d4) returned 1 [0241.290] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0241.290] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0241.290] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=18874884) returned 1 [0241.290] CloseHandle (hObject=0x370) returned 1 [0241.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0241.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0241.291] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0241.291] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0241.291] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0241.291] ReadFile (in: hFile=0x370, lpBuffer=0x3500058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3500058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0241.317] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0241.317] ReadFile (in: hFile=0x370, lpBuffer=0x3540058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3540058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0241.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0241.825] ReadFile (in: hFile=0x370, lpBuffer=0x3580058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3580058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0241.888] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfdfc | out: phKey=0x33dfdfc*=0x5a2ef0) returned 1 [0241.888] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0241.889] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0050) returned 1 [0241.895] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.895] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd8 | out: lpNewFilePointer=0x0) returned 1 [0241.895] WriteFile (in: hFile=0x370, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33dfde8, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfde8*=0xc0102, lpOverlapped=0x0) returned 1 [0241.908] SetEndOfFile (hFile=0x370) returned 1 [0241.908] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0241.908] WriteFile (in: hFile=0x370, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.910] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0241.910] WriteFile (in: hFile=0x370, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.913] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0241.913] WriteFile (in: hFile=0x370, lpBuffer=0x35c013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c013a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.915] CloseHandle (hObject=0x370) returned 1 [0241.915] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0241.915] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0241.916] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33dfe30 | out: lpFileSize=0x33dfe30*=2797568) returned 1 [0241.916] CloseHandle (hObject=0x370) returned 1 [0241.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0241.916] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0241.918] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0241.918] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0241.918] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0241.918] ReadFile (in: hFile=0x370, lpBuffer=0x3500058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3500058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0242.079] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0242.079] ReadFile (in: hFile=0x370, lpBuffer=0x3540058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3540058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0242.119] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda0 | out: lpNewFilePointer=0x0) returned 1 [0242.120] ReadFile (in: hFile=0x370, lpBuffer=0x3580058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfdac, lpOverlapped=0x0 | out: lpBuffer=0x3580058*, lpNumberOfBytesRead=0x33dfdac*=0x40000, lpOverlapped=0x0) returned 1 [0242.179] CryptImportKey (in: hProv=0x5a37b8, pbData=0x33dfd90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33dfdfc | out: phKey=0x33dfdfc*=0x5a2eb0) returned 1 [0242.179] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x33dfe98, dwFlags=0x0) returned 1 [0242.180] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3500020*, pdwDataLen=0x33dfdb0*=0xc0060) returned 1 [0242.186] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.186] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfdd8 | out: lpNewFilePointer=0x0) returned 1 [0242.186] WriteFile (in: hFile=0x370, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x33dfde8, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x33dfde8*=0xc0112, lpOverlapped=0x0) returned 1 [0242.206] SetEndOfFile (hFile=0x370) returned 1 [0242.206] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0242.206] WriteFile (in: hFile=0x370, lpBuffer=0x35c014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c014a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0242.208] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0242.208] WriteFile (in: hFile=0x370, lpBuffer=0x35c014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c014a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0242.259] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfda8 | out: lpNewFilePointer=0x0) returned 1 [0242.259] WriteFile (in: hFile=0x370, lpBuffer=0x35c014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfdb4, lpOverlapped=0x0 | out: lpBuffer=0x35c014a*, lpNumberOfBytesWritten=0x33dfdb4*=0x40000, lpOverlapped=0x0) returned 1 [0242.260] CloseHandle (hObject=0x370) returned 1 [0242.260] SetEvent (hEvent=0x2d4) returned 1 [0242.261] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x33dfe98 | out: pbBuffer=0x33dfe98) returned 1 [0242.261] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 101 os_tid = 0x8dc [0223.797] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x30ca918 [0223.797] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x3620048 [0223.798] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x297f00 [0223.798] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x110102) returned 0x3820020 [0223.798] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x50) returned 0x297f30 [0223.798] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc88, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afcf0 | out: phKey=0x31afcf0*=0x5a2d30) returned 1 [0223.798] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afcd8, dwFlags=0x0) returned 1 [0223.799] CryptDecrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f30, pdwDataLen=0x31afca4 | out: pbData=0x297f30, pdwDataLen=0x31afca4) returned 1 [0223.799] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0223.799] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0223.799] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0223.799] Wow64DisableWow64FsRedirection (in: OldValue=0x31afd40 | out: OldValue=0x31afd40*=0x0) returned 1 [0223.799] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f30 | out: hHeap=0x290000) returned 1 [0223.799] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0223.799] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0224.142] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=129) returned 1 [0224.142] CloseHandle (hObject=0x32c) returned 1 [0224.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0224.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.142] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0224.142] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0224.142] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0224.142] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0224.173] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0224.173] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0224.173] ReadFile (in: hFile=0x32c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x81, lpOverlapped=0x0) returned 1 [0224.181] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x90, dwBufLen=0x90 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x90) returned 1 [0226.884] WriteFile (in: hFile=0x33c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x90, lpOverlapped=0x0) returned 1 [0226.886] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0226.886] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0226.886] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0226.886] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0226.886] WriteFile (in: hFile=0x33c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0226.886] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0226.886] CloseHandle (hObject=0x32c) returned 1 [0226.886] CloseHandle (hObject=0x33c) returned 1 [0226.887] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0226.888] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0226.888] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0226.899] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=8192) returned 1 [0226.899] CloseHandle (hObject=0x33c) returned 1 [0226.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0226.899] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0226.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\bootsect.bak.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0226.899] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0226.900] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0226.900] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0226.900] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\bootsect.bak.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0226.900] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0226.900] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0226.900] ReadFile (in: hFile=0x33c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x2000, lpOverlapped=0x0) returned 1 [0226.945] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2010, dwBufLen=0x2010 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2010) returned 1 [0226.945] WriteFile (in: hFile=0x32c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x2010, lpOverlapped=0x0) returned 1 [0226.947] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0226.947] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0226.947] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0226.947] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0226.947] WriteFile (in: hFile=0x32c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0226.947] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0226.947] CloseHandle (hObject=0x33c) returned 1 [0226.947] CloseHandle (hObject=0x32c) returned 1 [0226.948] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0226.949] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor", dwFileAttributes=0x27) returned 1 [0226.949] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0226.949] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0226.951] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1450) returned 1 [0226.951] CloseHandle (hObject=0x32c) returned 1 [0226.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0226.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0226.951] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0226.951] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0226.951] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0226.951] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0226.951] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0226.952] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0226.952] ReadFile (in: hFile=0x32c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x5aa, lpOverlapped=0x0) returned 1 [0227.011] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0) returned 1 [0227.011] WriteFile (in: hFile=0x33c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x5b0, lpOverlapped=0x0) returned 1 [0227.012] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0227.012] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.012] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x50, dwBufLen=0x50 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x50) returned 1 [0227.012] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0227.013] WriteFile (in: hFile=0x33c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x102, lpOverlapped=0x0) returned 1 [0227.013] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.013] CloseHandle (hObject=0x32c) returned 1 [0227.013] CloseHandle (hObject=0x33c) returned 1 [0227.014] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0227.038] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.038] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.039] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=3186) returned 1 [0227.039] CloseHandle (hObject=0x334) returned 1 [0227.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0227.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.039] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.039] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.039] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.039] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.040] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2df0) returned 1 [0227.040] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.040] ReadFile (in: hFile=0x334, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0xc72, lpOverlapped=0x0) returned 1 [0227.042] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xc80, dwBufLen=0xc80 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xc80) returned 1 [0227.042] WriteFile (in: hFile=0x344, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xc80, lpOverlapped=0x0) returned 1 [0227.116] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0227.116] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.116] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.117] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0227.117] WriteFile (in: hFile=0x344, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.117] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.117] CloseHandle (hObject=0x334) returned 1 [0227.117] CloseHandle (hObject=0x344) returned 1 [0227.118] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0227.119] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.119] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.119] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=4207) returned 1 [0227.119] CloseHandle (hObject=0x344) returned 1 [0227.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.119] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.119] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.119] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.120] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.145] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0227.145] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.146] ReadFile (in: hFile=0x344, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x106f, lpOverlapped=0x0) returned 1 [0227.153] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1070, dwBufLen=0x1070 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1070) returned 1 [0227.153] WriteFile (in: hFile=0x334, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x1070, lpOverlapped=0x0) returned 1 [0227.154] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2df0) returned 1 [0227.154] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.154] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.154] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.154] WriteFile (in: hFile=0x334, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.154] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.154] CloseHandle (hObject=0x344) returned 1 [0227.154] CloseHandle (hObject=0x334) returned 1 [0227.155] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.156] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.156] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0227.422] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1800) returned 1 [0227.422] CloseHandle (hObject=0x338) returned 1 [0227.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0227.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.423] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0227.423] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.423] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.423] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0227.563] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2db0) returned 1 [0227.563] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.563] ReadFile (in: hFile=0x338, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x708, lpOverlapped=0x0) returned 1 [0227.564] CryptEncrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x710, dwBufLen=0x710 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x710) returned 1 [0227.564] WriteFile (in: hFile=0x350, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x710, lpOverlapped=0x0) returned 1 [0227.565] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2d30) returned 1 [0227.565] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.565] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.565] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.565] WriteFile (in: hFile=0x350, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.565] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.565] CloseHandle (hObject=0x338) returned 1 [0227.565] CloseHandle (hObject=0x350) returned 1 [0227.566] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0227.567] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.567] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.569] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2362) returned 1 [0227.569] CloseHandle (hObject=0x354) returned 1 [0227.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.569] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.569] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.569] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.569] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.570] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2db0) returned 1 [0227.570] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.570] ReadFile (in: hFile=0x354, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x93a, lpOverlapped=0x0) returned 1 [0227.571] CryptEncrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x940, dwBufLen=0x940 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x940) returned 1 [0227.571] WriteFile (in: hFile=0x334, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x940, lpOverlapped=0x0) returned 1 [0227.572] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2d30) returned 1 [0227.573] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.573] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.573] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.573] WriteFile (in: hFile=0x334, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.573] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.573] CloseHandle (hObject=0x354) returned 1 [0227.573] CloseHandle (hObject=0x334) returned 1 [0227.575] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.577] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.577] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.578] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1231) returned 1 [0227.578] CloseHandle (hObject=0x334) returned 1 [0227.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0227.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.578] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.578] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.578] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.578] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.579] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2db0) returned 1 [0227.579] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.579] ReadFile (in: hFile=0x334, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x4cf, lpOverlapped=0x0) returned 1 [0227.582] CryptEncrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4d0) returned 1 [0227.582] WriteFile (in: hFile=0x354, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x4d0, lpOverlapped=0x0) returned 1 [0227.583] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2d30) returned 1 [0227.583] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.583] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.583] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.583] WriteFile (in: hFile=0x354, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.583] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.583] CloseHandle (hObject=0x334) returned 1 [0227.583] CloseHandle (hObject=0x354) returned 1 [0227.584] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0227.585] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.585] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.586] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1852) returned 1 [0227.586] CloseHandle (hObject=0x354) returned 1 [0227.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.586] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.586] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.586] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.586] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.728] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0227.728] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.728] ReadFile (in: hFile=0x354, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x73c, lpOverlapped=0x0) returned 1 [0227.781] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x740, dwBufLen=0x740 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x740) returned 1 [0227.781] WriteFile (in: hFile=0x344, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x740, lpOverlapped=0x0) returned 1 [0227.783] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2df0) returned 1 [0227.783] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.783] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.783] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.783] WriteFile (in: hFile=0x344, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.783] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.783] CloseHandle (hObject=0x354) returned 1 [0227.783] CloseHandle (hObject=0x344) returned 1 [0227.784] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.785] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.785] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.804] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1452) returned 1 [0227.810] CloseHandle (hObject=0x344) returned 1 [0227.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0227.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.816] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.820] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.820] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.820] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.822] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0227.822] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.822] ReadFile (in: hFile=0x344, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x5ac, lpOverlapped=0x0) returned 1 [0227.824] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0) returned 1 [0227.825] WriteFile (in: hFile=0x354, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x5b0, lpOverlapped=0x0) returned 1 [0227.826] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0227.826] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.826] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.826] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0227.826] WriteFile (in: hFile=0x354, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.826] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.826] CloseHandle (hObject=0x344) returned 1 [0227.826] CloseHandle (hObject=0x354) returned 1 [0227.827] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0227.828] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.828] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.828] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=5557) returned 1 [0227.828] CloseHandle (hObject=0x354) returned 1 [0227.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0227.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.828] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.828] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.828] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.828] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.828] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0227.828] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.829] ReadFile (in: hFile=0x354, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x15b5, lpOverlapped=0x0) returned 1 [0227.831] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x15c0) returned 1 [0227.831] WriteFile (in: hFile=0x344, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x15c0, lpOverlapped=0x0) returned 1 [0227.832] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0227.832] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.832] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.832] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0227.832] WriteFile (in: hFile=0x344, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.832] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.832] CloseHandle (hObject=0x354) returned 1 [0227.832] CloseHandle (hObject=0x344) returned 1 [0227.833] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0227.834] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.834] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.834] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=819) returned 1 [0227.834] CloseHandle (hObject=0x344) returned 1 [0227.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0227.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.834] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.834] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.834] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.834] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.835] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0227.835] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.835] ReadFile (in: hFile=0x344, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x333, lpOverlapped=0x0) returned 1 [0227.837] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x340, dwBufLen=0x340 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x340) returned 1 [0227.837] WriteFile (in: hFile=0x354, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x340, lpOverlapped=0x0) returned 1 [0227.838] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0227.838] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.838] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x50, dwBufLen=0x50 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x50) returned 1 [0227.838] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0227.838] WriteFile (in: hFile=0x354, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x102, lpOverlapped=0x0) returned 1 [0227.838] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.838] CloseHandle (hObject=0x344) returned 1 [0227.838] CloseHandle (hObject=0x354) returned 1 [0227.839] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0227.840] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.840] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.845] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=27195) returned 1 [0227.845] CloseHandle (hObject=0x354) returned 1 [0227.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0227.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.845] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.845] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.845] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.845] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.845] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0227.845] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.845] ReadFile (in: hFile=0x354, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x6a3b, lpOverlapped=0x0) returned 1 [0227.849] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x6a40) returned 1 [0227.850] WriteFile (in: hFile=0x344, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x6a40, lpOverlapped=0x0) returned 1 [0227.851] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0227.851] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.851] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.851] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0227.851] WriteFile (in: hFile=0x344, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.851] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.851] CloseHandle (hObject=0x354) returned 1 [0227.851] CloseHandle (hObject=0x344) returned 1 [0227.852] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0227.853] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0227.853] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.853] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=67190) returned 1 [0227.853] CloseHandle (hObject=0x344) returned 1 [0227.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0227.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.854] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.854] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.854] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0227.854] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0227.854] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0227.854] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.854] ReadFile (in: hFile=0x344, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x10676, lpOverlapped=0x0) returned 1 [0227.970] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x10680, dwBufLen=0x10680 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x10680) returned 1 [0227.970] WriteFile (in: hFile=0x354, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x10680, lpOverlapped=0x0) returned 1 [0227.972] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0227.972] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0227.972] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0227.972] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0227.972] WriteFile (in: hFile=0x354, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0227.972] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.972] CloseHandle (hObject=0x344) returned 1 [0227.972] CloseHandle (hObject=0x354) returned 1 [0227.974] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0228.104] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0228.104] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0228.106] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1349) returned 1 [0228.107] CloseHandle (hObject=0x374) returned 1 [0228.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0228.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0228.107] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0228.107] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0228.107] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0228.107] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.107] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0228.107] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0228.107] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x545, lpOverlapped=0x0) returned 1 [0228.109] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x550, dwBufLen=0x550 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x550) returned 1 [0228.109] WriteFile (in: hFile=0x378, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x550, lpOverlapped=0x0) returned 1 [0228.110] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0228.110] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0228.110] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0228.110] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0228.110] WriteFile (in: hFile=0x378, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0228.110] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0228.110] CloseHandle (hObject=0x374) returned 1 [0228.110] CloseHandle (hObject=0x378) returned 1 [0228.111] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0228.112] SetEvent (hEvent=0x2ec) returned 1 [0228.112] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0228.112] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.113] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=596341) returned 1 [0228.113] CloseHandle (hObject=0x378) returned 1 [0228.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0228.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0228.113] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.113] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0228.113] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0228.113] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0228.113] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2d30) returned 1 [0228.113] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0228.113] ReadFile (in: hFile=0x378, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x91975, lpOverlapped=0x0) returned 1 [0228.120] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x91980, dwBufLen=0x91980 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x91980) returned 1 [0228.125] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x91980, lpOverlapped=0x0) returned 1 [0228.136] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0228.136] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0228.136] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0228.136] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0228.136] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0228.137] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0228.137] CloseHandle (hObject=0x378) returned 1 [0228.137] CloseHandle (hObject=0x374) returned 1 [0229.583] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0229.595] SetEvent (hEvent=0x2ec) returned 1 [0229.596] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0229.596] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0229.596] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=31094) returned 1 [0229.596] CloseHandle (hObject=0x374) returned 1 [0229.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0229.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.596] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0229.596] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.596] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.596] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0229.597] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0229.597] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.597] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x7976, lpOverlapped=0x0) returned 1 [0229.601] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x7980, dwBufLen=0x7980 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x7980) returned 1 [0229.601] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x7980, lpOverlapped=0x0) returned 1 [0229.602] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2fb0) returned 1 [0229.602] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.602] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0229.602] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.602] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0229.603] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0229.603] CloseHandle (hObject=0x374) returned 1 [0229.603] CloseHandle (hObject=0x38c) returned 1 [0229.604] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0229.605] SetEvent (hEvent=0x2ec) returned 1 [0229.605] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0229.605] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0229.606] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=4274) returned 1 [0229.606] CloseHandle (hObject=0x38c) returned 1 [0229.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0229.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.606] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0229.606] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.606] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.606] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0229.607] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0229.607] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.607] ReadFile (in: hFile=0x38c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x10b2, lpOverlapped=0x0) returned 1 [0229.608] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x10c0) returned 1 [0229.608] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x10c0, lpOverlapped=0x0) returned 1 [0229.609] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2fb0) returned 1 [0229.609] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.609] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0229.609] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.609] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0229.609] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0229.609] CloseHandle (hObject=0x38c) returned 1 [0229.609] CloseHandle (hObject=0x374) returned 1 [0229.610] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0229.611] SetEvent (hEvent=0x2ec) returned 1 [0229.611] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0229.611] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0229.612] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=6421) returned 1 [0229.612] CloseHandle (hObject=0x374) returned 1 [0229.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0229.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.612] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0229.612] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.612] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.612] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0229.613] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0229.613] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.613] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x1915, lpOverlapped=0x0) returned 1 [0229.614] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1920, dwBufLen=0x1920 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1920) returned 1 [0229.614] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x1920, lpOverlapped=0x0) returned 1 [0229.615] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2fb0) returned 1 [0229.615] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.615] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0229.615] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.615] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0229.615] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0229.615] CloseHandle (hObject=0x374) returned 1 [0229.615] CloseHandle (hObject=0x38c) returned 1 [0229.616] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0229.617] SetEvent (hEvent=0x2ec) returned 1 [0229.617] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0229.617] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0229.618] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=16683) returned 1 [0229.618] CloseHandle (hObject=0x38c) returned 1 [0229.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0229.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0229.618] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.618] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0229.619] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0229.619] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.619] ReadFile (in: hFile=0x38c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x412b, lpOverlapped=0x0) returned 1 [0229.620] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4130, dwBufLen=0x4130 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4130) returned 1 [0229.621] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x4130, lpOverlapped=0x0) returned 1 [0229.622] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2fb0) returned 1 [0229.622] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.622] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0229.622] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.622] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0229.622] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0229.622] CloseHandle (hObject=0x38c) returned 1 [0229.622] CloseHandle (hObject=0x374) returned 1 [0229.623] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0229.624] SetEvent (hEvent=0x2ec) returned 1 [0229.624] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0229.624] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0229.625] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=4274) returned 1 [0229.625] CloseHandle (hObject=0x374) returned 1 [0229.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0229.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.625] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0229.625] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.625] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0229.625] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0229.626] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0229.626] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0229.626] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x10b2, lpOverlapped=0x0) returned 1 [0230.386] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x10c0) returned 1 [0230.386] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x10c0, lpOverlapped=0x0) returned 1 [0230.387] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0230.387] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0230.387] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0230.387] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0230.387] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0230.387] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0230.387] CloseHandle (hObject=0x374) returned 1 [0230.387] CloseHandle (hObject=0x38c) returned 1 [0230.388] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0230.389] SetEvent (hEvent=0x2ec) returned 1 [0230.389] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.687] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=791686) returned 1 [0230.687] CloseHandle (hObject=0x388) returned 1 [0230.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0230.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.687] SetEvent (hEvent=0x2ec) returned 1 [0230.687] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.689] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=89600) returned 1 [0230.689] CloseHandle (hObject=0x388) returned 1 [0230.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0230.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.689] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.690] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=31744) returned 1 [0230.690] CloseHandle (hObject=0x388) returned 1 [0230.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0230.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.690] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.691] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=33280) returned 1 [0230.691] CloseHandle (hObject=0x388) returned 1 [0230.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0230.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.691] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.691] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=62976) returned 1 [0230.691] CloseHandle (hObject=0x388) returned 1 [0230.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0230.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.692] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.692] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=197120) returned 1 [0230.692] CloseHandle (hObject=0x388) returned 1 [0230.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0230.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.692] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0230.693] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=224256) returned 1 [0230.693] CloseHandle (hObject=0x384) returned 1 [0230.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0230.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.694] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0230.694] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=222208) returned 1 [0230.694] CloseHandle (hObject=0x384) returned 1 [0230.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0230.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.694] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0230.694] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=194048) returned 1 [0230.695] CloseHandle (hObject=0x384) returned 1 [0230.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0230.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.695] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0230.695] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1600388) returned 1 [0230.695] CloseHandle (hObject=0x384) returned 1 [0230.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0230.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0230.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0230.696] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0230.697] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1434) returned 1 [0230.697] CloseHandle (hObject=0x384) returned 1 [0230.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0230.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.698] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0230.698] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=212) returned 1 [0230.698] CloseHandle (hObject=0x384) returned 1 [0230.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0230.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.699] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0230.699] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=384) returned 1 [0230.699] CloseHandle (hObject=0x384) returned 1 [0230.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0230.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.700] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.700] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1118) returned 1 [0230.700] CloseHandle (hObject=0x388) returned 1 [0230.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0230.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.701] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.701] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=392) returned 1 [0230.701] CloseHandle (hObject=0x388) returned 1 [0230.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0230.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.702] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.702] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=727) returned 1 [0230.702] CloseHandle (hObject=0x388) returned 1 [0230.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0230.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.703] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.704] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=3150) returned 1 [0230.704] CloseHandle (hObject=0x388) returned 1 [0230.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0230.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.704] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.705] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=247) returned 1 [0230.705] CloseHandle (hObject=0x388) returned 1 [0230.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0230.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.705] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.708] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=3161) returned 1 [0230.708] CloseHandle (hObject=0x388) returned 1 [0230.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0230.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.708] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.709] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=3166) returned 1 [0230.709] CloseHandle (hObject=0x388) returned 1 [0230.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0230.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.709] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.710] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=738) returned 1 [0230.710] CloseHandle (hObject=0x388) returned 1 [0230.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0230.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.710] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.710] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=804) returned 1 [0230.710] CloseHandle (hObject=0x388) returned 1 [0230.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0230.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.711] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.712] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=488) returned 1 [0230.712] CloseHandle (hObject=0x388) returned 1 [0230.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0230.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.712] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.712] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=617) returned 1 [0230.712] CloseHandle (hObject=0x388) returned 1 [0230.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0230.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.713] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.714] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=16616) returned 1 [0230.714] CloseHandle (hObject=0x388) returned 1 [0230.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0230.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.714] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.715] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=9803) returned 1 [0230.715] CloseHandle (hObject=0x388) returned 1 [0230.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0230.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.715] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.715] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=11067) returned 1 [0230.716] CloseHandle (hObject=0x388) returned 1 [0230.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0230.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.716] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0230.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.090] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=10947) returned 1 [0231.090] CloseHandle (hObject=0x388) returned 1 [0231.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0231.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.091] SetEvent (hEvent=0x2ec) returned 1 [0231.091] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.195] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2626) returned 1 [0231.195] CloseHandle (hObject=0x388) returned 1 [0231.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0231.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.195] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.195] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2568) returned 1 [0231.195] CloseHandle (hObject=0x388) returned 1 [0231.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0231.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.196] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.196] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2596) returned 1 [0231.196] CloseHandle (hObject=0x388) returned 1 [0231.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0231.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.197] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.197] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2520) returned 1 [0231.197] CloseHandle (hObject=0x388) returned 1 [0231.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0231.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.197] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.198] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1680383) returned 1 [0231.198] CloseHandle (hObject=0x388) returned 1 [0231.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20 [0231.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0231.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.199] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc50 | out: lpNewFilePointer=0x0) returned 1 [0231.199] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc50 | out: lpNewFilePointer=0x0) returned 1 [0231.199] ReadFile (in: hFile=0x388, lpBuffer=0x3820058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afc5c, lpOverlapped=0x0 | out: lpBuffer=0x3820058*, lpNumberOfBytesRead=0x31afc5c*=0x40000, lpOverlapped=0x0) returned 1 [0231.203] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x31afc50 | out: lpNewFilePointer=0x0) returned 1 [0231.203] ReadFile (in: hFile=0x388, lpBuffer=0x3860058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afc5c, lpOverlapped=0x0 | out: lpBuffer=0x3860058*, lpNumberOfBytesRead=0x31afc5c*=0x40000, lpOverlapped=0x0) returned 1 [0231.208] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x31afc50 | out: lpNewFilePointer=0x0) returned 1 [0231.208] ReadFile (in: hFile=0x388, lpBuffer=0x38a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afc5c, lpOverlapped=0x0 | out: lpBuffer=0x38a0058*, lpNumberOfBytesRead=0x31afc5c*=0x40000, lpOverlapped=0x0) returned 1 [0231.214] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afcac | out: phKey=0x31afcac*=0x5a2cb0) returned 1 [0231.214] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.215] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc60*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3820020*, pdwDataLen=0x31afc60*=0xc0050) returned 1 [0231.221] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0231.221] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc88 | out: lpNewFilePointer=0x0) returned 1 [0231.221] WriteFile (in: hFile=0x388, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31afc98, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afc98*=0xc0102, lpOverlapped=0x0) returned 1 [0231.340] SetEndOfFile (hFile=0x388) returned 1 [0231.340] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x31afc58 | out: lpNewFilePointer=0x0) returned 1 [0231.340] WriteFile (in: hFile=0x388, lpBuffer=0x38e013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afc64, lpOverlapped=0x0 | out: lpBuffer=0x38e013a*, lpNumberOfBytesWritten=0x31afc64*=0x40000, lpOverlapped=0x0) returned 1 [0231.342] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x31afc58 | out: lpNewFilePointer=0x0) returned 1 [0231.343] WriteFile (in: hFile=0x388, lpBuffer=0x38e013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afc64, lpOverlapped=0x0 | out: lpBuffer=0x38e013a*, lpNumberOfBytesWritten=0x31afc64*=0x40000, lpOverlapped=0x0) returned 1 [0231.345] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc58 | out: lpNewFilePointer=0x0) returned 1 [0231.345] WriteFile (in: hFile=0x388, lpBuffer=0x38e013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afc64, lpOverlapped=0x0 | out: lpBuffer=0x38e013a*, lpNumberOfBytesWritten=0x31afc64*=0x40000, lpOverlapped=0x0) returned 1 [0231.346] CloseHandle (hObject=0x388) returned 1 [0231.786] SetEvent (hEvent=0x2ec) returned 1 [0231.787] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.787] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1565) returned 1 [0231.787] CloseHandle (hObject=0x388) returned 1 [0231.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0231.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.787] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.788] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0231.788] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0231.788] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.788] ReadFile (in: hFile=0x388, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x61d, lpOverlapped=0x0) returned 1 [0231.790] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x620, dwBufLen=0x620 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x620) returned 1 [0231.790] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x620, lpOverlapped=0x0) returned 1 [0231.790] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0231.790] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.791] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0231.791] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.791] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0231.791] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.791] CloseHandle (hObject=0x388) returned 1 [0231.791] CloseHandle (hObject=0x38c) returned 1 [0231.792] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0231.792] SetEvent (hEvent=0x2ec) returned 1 [0231.793] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0231.794] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2296) returned 1 [0231.794] CloseHandle (hObject=0x38c) returned 1 [0231.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0231.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0231.794] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.794] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.796] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0231.796] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.796] ReadFile (in: hFile=0x38c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x8f8, lpOverlapped=0x0) returned 1 [0231.797] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x900, dwBufLen=0x900 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x900) returned 1 [0231.797] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x900, lpOverlapped=0x0) returned 1 [0231.798] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0231.798] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.798] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0231.798] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.798] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0231.798] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.798] CloseHandle (hObject=0x38c) returned 1 [0231.798] CloseHandle (hObject=0x398) returned 1 [0231.799] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0231.800] SetEvent (hEvent=0x2ec) returned 1 [0231.800] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.800] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=913) returned 1 [0231.800] CloseHandle (hObject=0x398) returned 1 [0231.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0231.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.801] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.801] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.802] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0231.802] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.802] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x391, lpOverlapped=0x0) returned 1 [0231.804] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x3a0) returned 1 [0231.804] WriteFile (in: hFile=0x388, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x3a0, lpOverlapped=0x0) returned 1 [0231.805] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0231.805] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.805] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0231.805] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.805] WriteFile (in: hFile=0x388, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0231.805] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.805] CloseHandle (hObject=0x398) returned 1 [0231.805] CloseHandle (hObject=0x388) returned 1 [0231.806] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0231.807] SetEvent (hEvent=0x2ec) returned 1 [0231.807] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.808] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1452) returned 1 [0231.808] CloseHandle (hObject=0x388) returned 1 [0231.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0231.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.808] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.808] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.808] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0231.808] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.808] ReadFile (in: hFile=0x388, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x5ac, lpOverlapped=0x0) returned 1 [0231.810] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0) returned 1 [0231.810] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x5b0, lpOverlapped=0x0) returned 1 [0231.810] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0231.810] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.810] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0231.811] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.811] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0231.811] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.811] CloseHandle (hObject=0x388) returned 1 [0231.811] CloseHandle (hObject=0x398) returned 1 [0231.811] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0231.812] SetEvent (hEvent=0x2ec) returned 1 [0231.812] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.813] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1231) returned 1 [0231.813] CloseHandle (hObject=0x398) returned 1 [0231.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0231.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.813] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.813] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0231.815] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0231.815] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.815] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x4cf, lpOverlapped=0x0) returned 1 [0231.820] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4d0) returned 1 [0231.820] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x4d0, lpOverlapped=0x0) returned 1 [0231.821] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0231.853] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.853] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0231.853] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.853] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0231.853] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.853] CloseHandle (hObject=0x398) returned 1 [0231.853] CloseHandle (hObject=0x38c) returned 1 [0231.854] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0231.855] SetEvent (hEvent=0x2ec) returned 1 [0231.855] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0231.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0231.855] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1852) returned 1 [0231.855] CloseHandle (hObject=0x38c) returned 1 [0231.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0231.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0231.855] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.856] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0231.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.856] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0231.856] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.856] ReadFile (in: hFile=0x38c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x73c, lpOverlapped=0x0) returned 1 [0231.865] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x740, dwBufLen=0x740 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x740) returned 1 [0231.865] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x740, lpOverlapped=0x0) returned 1 [0231.866] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0231.866] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0231.866] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0231.866] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.866] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0231.866] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.866] CloseHandle (hObject=0x38c) returned 1 [0231.866] CloseHandle (hObject=0x398) returned 1 [0231.867] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0233.064] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0233.088] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=71236) returned 1 [0233.088] CloseHandle (hObject=0x38c) returned 1 [0233.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0233.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0233.088] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.088] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.088] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0233.088] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.088] ReadFile (in: hFile=0x38c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x11644, lpOverlapped=0x0) returned 1 [0233.121] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x11650, dwBufLen=0x11650 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x11650) returned 1 [0233.122] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x11650, lpOverlapped=0x0) returned 1 [0233.124] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0233.124] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.124] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x30, dwBufLen=0x30 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x30) returned 1 [0233.124] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.124] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xe2, lpOverlapped=0x0) returned 1 [0233.124] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0233.124] CloseHandle (hObject=0x38c) returned 1 [0233.124] CloseHandle (hObject=0x374) returned 1 [0233.127] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0233.601] SetEvent (hEvent=0x2ec) returned 1 [0233.601] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.601] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=819) returned 1 [0233.601] CloseHandle (hObject=0x374) returned 1 [0233.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0233.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.601] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.601] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0233.602] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0233.602] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.602] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x333, lpOverlapped=0x0) returned 1 [0233.603] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x340, dwBufLen=0x340 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x340) returned 1 [0233.603] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x340, lpOverlapped=0x0) returned 1 [0233.604] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0233.604] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.604] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x50, dwBufLen=0x50 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x50) returned 1 [0233.604] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0233.604] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x102, lpOverlapped=0x0) returned 1 [0233.604] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.605] CloseHandle (hObject=0x374) returned 1 [0233.605] CloseHandle (hObject=0x38c) returned 1 [0233.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0233.606] SetEvent (hEvent=0x2ec) returned 1 [0233.606] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0233.607] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=37689) returned 1 [0233.607] CloseHandle (hObject=0x38c) returned 1 [0233.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0233.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0233.608] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.608] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.608] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0233.608] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.608] ReadFile (in: hFile=0x38c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x9339, lpOverlapped=0x0) returned 1 [0233.611] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x9340, dwBufLen=0x9340 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x9340) returned 1 [0233.611] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x9340, lpOverlapped=0x0) returned 1 [0233.613] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0233.613] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.613] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0233.613] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0233.613] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0233.613] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.613] CloseHandle (hObject=0x38c) returned 1 [0233.613] CloseHandle (hObject=0x374) returned 1 [0233.614] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0233.615] SetEvent (hEvent=0x2ec) returned 1 [0233.615] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.616] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=26929) returned 1 [0233.616] CloseHandle (hObject=0x374) returned 1 [0233.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0233.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.616] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.616] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0233.616] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0233.616] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.616] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x6931, lpOverlapped=0x0) returned 1 [0233.618] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x6940, dwBufLen=0x6940 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x6940) returned 1 [0233.619] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x6940, lpOverlapped=0x0) returned 1 [0233.620] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0233.620] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.620] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0233.620] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0233.620] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0233.620] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.620] CloseHandle (hObject=0x374) returned 1 [0233.620] CloseHandle (hObject=0x38c) returned 1 [0233.621] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0233.622] SetEvent (hEvent=0x2ec) returned 1 [0233.622] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.624] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=27195) returned 1 [0233.624] CloseHandle (hObject=0x374) returned 1 [0233.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0233.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.624] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.624] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.625] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0233.625] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.625] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x6a3b, lpOverlapped=0x0) returned 1 [0233.627] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x6a40) returned 1 [0233.627] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x6a40, lpOverlapped=0x0) returned 1 [0233.628] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0233.628] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.628] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0233.628] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.628] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0233.628] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.628] CloseHandle (hObject=0x374) returned 1 [0233.628] CloseHandle (hObject=0x398) returned 1 [0233.629] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0233.630] SetEvent (hEvent=0x2ec) returned 1 [0233.631] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.631] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=67190) returned 1 [0233.631] CloseHandle (hObject=0x398) returned 1 [0233.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0233.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.632] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.632] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.632] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0233.632] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.632] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x10676, lpOverlapped=0x0) returned 1 [0233.634] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x10680, dwBufLen=0x10680 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x10680) returned 1 [0233.635] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x10680, lpOverlapped=0x0) returned 1 [0233.636] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2fb0) returned 1 [0233.636] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.636] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0233.636] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.636] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0233.637] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.637] CloseHandle (hObject=0x398) returned 1 [0233.637] CloseHandle (hObject=0x374) returned 1 [0233.638] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0233.639] SetEvent (hEvent=0x2ec) returned 1 [0233.639] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.639] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=9352) returned 1 [0233.639] CloseHandle (hObject=0x374) returned 1 [0233.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0233.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.640] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.640] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.640] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0233.640] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.640] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x2488, lpOverlapped=0x0) returned 1 [0233.879] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2490, dwBufLen=0x2490 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2490) returned 1 [0233.879] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x2490, lpOverlapped=0x0) returned 1 [0233.880] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0233.880] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.880] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0233.881] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.881] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0233.881] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.881] CloseHandle (hObject=0x374) returned 1 [0233.881] CloseHandle (hObject=0x398) returned 1 [0233.883] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0233.884] SetEvent (hEvent=0x2ec) returned 1 [0233.884] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.885] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=3186) returned 1 [0233.885] CloseHandle (hObject=0x398) returned 1 [0233.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0233.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.885] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.885] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.891] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2e70) returned 1 [0233.891] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.891] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0xc72, lpOverlapped=0x0) returned 1 [0233.964] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xc80, dwBufLen=0xc80 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xc80) returned 1 [0233.964] WriteFile (in: hFile=0x39c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xc80, lpOverlapped=0x0) returned 1 [0233.965] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0233.965] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.965] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0233.965] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.965] WriteFile (in: hFile=0x39c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0233.965] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.965] CloseHandle (hObject=0x398) returned 1 [0233.965] CloseHandle (hObject=0x39c) returned 1 [0233.966] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0233.970] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.970] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1450) returned 1 [0233.970] CloseHandle (hObject=0x39c) returned 1 [0233.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0233.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.970] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.970] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.972] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0233.972] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.972] ReadFile (in: hFile=0x39c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x5aa, lpOverlapped=0x0) returned 1 [0233.973] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0) returned 1 [0233.974] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x5b0, lpOverlapped=0x0) returned 1 [0233.974] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0233.975] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.975] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x50, dwBufLen=0x50 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x50) returned 1 [0233.975] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.975] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x102, lpOverlapped=0x0) returned 1 [0233.975] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0233.975] CloseHandle (hObject=0x39c) returned 1 [0233.975] CloseHandle (hObject=0x398) returned 1 [0233.979] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0233.980] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.981] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1886) returned 1 [0233.981] CloseHandle (hObject=0x398) returned 1 [0233.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0233.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.981] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.981] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.982] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0233.982] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.982] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x75e, lpOverlapped=0x0) returned 1 [0233.983] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x760, dwBufLen=0x760 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x760) returned 1 [0233.983] WriteFile (in: hFile=0x39c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x760, lpOverlapped=0x0) returned 1 [0233.984] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0233.984] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.984] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0233.984] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.984] WriteFile (in: hFile=0x39c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0233.984] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0233.984] CloseHandle (hObject=0x398) returned 1 [0233.984] CloseHandle (hObject=0x39c) returned 1 [0233.986] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0233.987] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0233.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.988] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=6421) returned 1 [0233.988] CloseHandle (hObject=0x398) returned 1 [0233.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0233.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.989] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.989] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0233.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0233.989] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0233.989] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0233.989] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x1915, lpOverlapped=0x0) returned 1 [0234.102] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1920, dwBufLen=0x1920 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1920) returned 1 [0234.102] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x1920, lpOverlapped=0x0) returned 1 [0234.103] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0234.103] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.103] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.103] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.103] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.103] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.103] CloseHandle (hObject=0x398) returned 1 [0234.103] CloseHandle (hObject=0x370) returned 1 [0234.107] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0234.108] SetEvent (hEvent=0x2ec) returned 1 [0234.109] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.240] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1457) returned 1 [0234.240] CloseHandle (hObject=0x370) returned 1 [0234.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0234.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.241] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.241] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.241] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0234.241] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.241] ReadFile (in: hFile=0x370, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x5b1, lpOverlapped=0x0) returned 1 [0234.243] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5c0) returned 1 [0234.243] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x5c0, lpOverlapped=0x0) returned 1 [0234.244] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0234.244] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.244] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.244] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.244] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.244] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.244] CloseHandle (hObject=0x370) returned 1 [0234.244] CloseHandle (hObject=0x398) returned 1 [0234.245] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0234.246] SetEvent (hEvent=0x2ec) returned 1 [0234.246] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.248] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1608) returned 1 [0234.248] CloseHandle (hObject=0x398) returned 1 [0234.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0234.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.248] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.248] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.249] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0234.249] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.249] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x648, lpOverlapped=0x0) returned 1 [0234.250] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x650, dwBufLen=0x650 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x650) returned 1 [0234.250] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x650, lpOverlapped=0x0) returned 1 [0234.251] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0234.251] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.251] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.251] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.251] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.251] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.251] CloseHandle (hObject=0x398) returned 1 [0234.251] CloseHandle (hObject=0x370) returned 1 [0234.252] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0234.253] SetEvent (hEvent=0x2ec) returned 1 [0234.253] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.254] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=6241) returned 1 [0234.254] CloseHandle (hObject=0x370) returned 1 [0234.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0234.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.254] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.254] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.255] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0234.255] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.255] ReadFile (in: hFile=0x370, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x1861, lpOverlapped=0x0) returned 1 [0234.256] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1870, dwBufLen=0x1870 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1870) returned 1 [0234.256] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x1870, lpOverlapped=0x0) returned 1 [0234.257] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0234.257] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.257] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.257] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.257] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.257] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.257] CloseHandle (hObject=0x370) returned 1 [0234.258] CloseHandle (hObject=0x398) returned 1 [0234.258] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0234.259] SetEvent (hEvent=0x2ec) returned 1 [0234.259] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.260] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=9503) returned 1 [0234.260] CloseHandle (hObject=0x398) returned 1 [0234.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0234.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.260] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.260] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.262] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0234.262] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.262] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x251f, lpOverlapped=0x0) returned 1 [0234.264] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2520, dwBufLen=0x2520 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2520) returned 1 [0234.264] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x2520, lpOverlapped=0x0) returned 1 [0234.265] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0234.265] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.265] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.265] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.265] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.265] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.265] CloseHandle (hObject=0x398) returned 1 [0234.265] CloseHandle (hObject=0x340) returned 1 [0234.413] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0234.414] SetEvent (hEvent=0x2ec) returned 1 [0234.414] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.414] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=8918) returned 1 [0234.414] CloseHandle (hObject=0x340) returned 1 [0234.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0234.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.415] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.415] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.593] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0234.593] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.593] ReadFile (in: hFile=0x340, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x22d6, lpOverlapped=0x0) returned 1 [0234.594] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x22e0) returned 1 [0234.594] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x22e0, lpOverlapped=0x0) returned 1 [0234.595] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0234.595] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.595] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.595] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.595] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.595] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.595] CloseHandle (hObject=0x340) returned 1 [0234.596] CloseHandle (hObject=0x38c) returned 1 [0234.596] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0234.598] SetEvent (hEvent=0x2ec) returned 1 [0234.598] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.601] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=39017) returned 1 [0234.601] CloseHandle (hObject=0x340) returned 1 [0234.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0234.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.602] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.602] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.602] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0234.602] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.602] ReadFile (in: hFile=0x340, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x9869, lpOverlapped=0x0) returned 1 [0234.645] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x9870, dwBufLen=0x9870 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x9870) returned 1 [0234.645] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x9870, lpOverlapped=0x0) returned 1 [0234.646] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0234.646] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.647] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.647] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.647] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.647] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.647] CloseHandle (hObject=0x340) returned 1 [0234.647] CloseHandle (hObject=0x370) returned 1 [0234.648] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0234.649] SetEvent (hEvent=0x2ec) returned 1 [0234.649] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.649] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2687) returned 1 [0234.649] CloseHandle (hObject=0x370) returned 1 [0234.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0234.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.650] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.650] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.650] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0234.650] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.650] ReadFile (in: hFile=0x370, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0xa7f, lpOverlapped=0x0) returned 1 [0234.652] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xa80, dwBufLen=0xa80 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xa80) returned 1 [0234.652] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xa80, lpOverlapped=0x0) returned 1 [0234.652] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0234.652] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.652] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.653] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.653] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.653] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.653] CloseHandle (hObject=0x370) returned 1 [0234.653] CloseHandle (hObject=0x340) returned 1 [0234.654] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0234.655] SetEvent (hEvent=0x2ec) returned 1 [0234.655] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.656] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=8564) returned 1 [0234.656] CloseHandle (hObject=0x340) returned 1 [0234.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0234.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.656] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.656] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.657] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0234.657] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.657] ReadFile (in: hFile=0x340, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x2174, lpOverlapped=0x0) returned 1 [0234.658] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2180, dwBufLen=0x2180 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2180) returned 1 [0234.658] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x2180, lpOverlapped=0x0) returned 1 [0234.659] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0234.659] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.659] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0234.659] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.659] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0234.659] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.659] CloseHandle (hObject=0x340) returned 1 [0234.659] CloseHandle (hObject=0x370) returned 1 [0234.660] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0234.661] SetEvent (hEvent=0x2ec) returned 1 [0234.661] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0234.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.662] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=227311) returned 1 [0234.662] CloseHandle (hObject=0x38c) returned 1 [0234.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0234.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.665] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.665] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0234.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.665] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0234.665] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0234.665] ReadFile (in: hFile=0x38c, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x377ef, lpOverlapped=0x0) returned 1 [0236.131] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x377f0, dwBufLen=0x377f0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x377f0) returned 1 [0236.156] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x377f0, lpOverlapped=0x0) returned 1 [0236.536] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0236.536] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0236.536] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0236.536] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0236.536] WriteFile (in: hFile=0x370, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0236.536] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0236.536] CloseHandle (hObject=0x38c) returned 1 [0236.537] CloseHandle (hObject=0x370) returned 1 [0236.539] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0236.542] SetEvent (hEvent=0x2ec) returned 1 [0236.542] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.542] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1074) returned 1 [0236.542] CloseHandle (hObject=0x370) returned 1 [0236.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0236.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.543] SetEvent (hEvent=0x2ec) returned 1 [0236.543] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.544] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2575) returned 1 [0236.544] CloseHandle (hObject=0x370) returned 1 [0236.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0236.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.544] SetEvent (hEvent=0x2ec) returned 1 [0236.544] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.544] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=4587) returned 1 [0236.544] CloseHandle (hObject=0x370) returned 1 [0236.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0236.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.545] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.545] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2319) returned 1 [0236.545] CloseHandle (hObject=0x370) returned 1 [0236.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0236.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.545] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.546] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=645) returned 1 [0236.546] CloseHandle (hObject=0x370) returned 1 [0236.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0236.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.546] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0236.546] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0236.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0236.546] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0236.546] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0236.546] ReadFile (in: hFile=0x370, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x285, lpOverlapped=0x0) returned 1 [0236.547] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x290, dwBufLen=0x290 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x290) returned 1 [0236.547] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x290, lpOverlapped=0x0) returned 1 [0236.548] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0236.548] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0236.548] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0236.548] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0236.548] WriteFile (in: hFile=0x38c, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0236.549] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0236.549] CloseHandle (hObject=0x370) returned 1 [0236.549] CloseHandle (hObject=0x38c) returned 1 [0236.549] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0236.550] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0236.550] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=3792) returned 1 [0236.551] CloseHandle (hObject=0x38c) returned 1 [0236.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0236.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.551] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0236.551] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=231) returned 1 [0236.551] CloseHandle (hObject=0x38c) returned 1 [0236.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0236.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.552] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0236.552] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=23871) returned 1 [0236.552] CloseHandle (hObject=0x38c) returned 1 [0236.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0236.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.553] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.555] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=5524) returned 1 [0236.555] CloseHandle (hObject=0x370) returned 1 [0236.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0236.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.555] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.555] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=10340) returned 1 [0236.555] CloseHandle (hObject=0x370) returned 1 [0236.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0236.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.556] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.557] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=116724) returned 1 [0236.557] CloseHandle (hObject=0x370) returned 1 [0236.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0236.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.557] SetEvent (hEvent=0x2ec) returned 1 [0236.557] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.558] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=237) returned 1 [0236.558] CloseHandle (hObject=0x370) returned 1 [0236.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0236.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.558] SetEvent (hEvent=0x2ec) returned 1 [0236.558] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.559] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=6406) returned 1 [0236.559] CloseHandle (hObject=0x370) returned 1 [0236.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0236.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.559] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.559] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2920) returned 1 [0236.559] CloseHandle (hObject=0x370) returned 1 [0236.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0236.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.560] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.560] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=7498) returned 1 [0236.560] CloseHandle (hObject=0x370) returned 1 [0236.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0236.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.560] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.563] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=235) returned 1 [0236.563] CloseHandle (hObject=0x370) returned 1 [0236.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0236.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.564] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.564] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=4222) returned 1 [0236.564] CloseHandle (hObject=0x370) returned 1 [0236.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0236.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.564] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.565] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=152300) returned 1 [0236.565] CloseHandle (hObject=0x370) returned 1 [0236.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0236.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.566] SetEvent (hEvent=0x2ec) returned 1 [0236.566] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.566] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2209) returned 1 [0236.566] CloseHandle (hObject=0x370) returned 1 [0236.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0236.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.566] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.566] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=4192) returned 1 [0236.567] CloseHandle (hObject=0x370) returned 1 [0236.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0236.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.567] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.568] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=26036) returned 1 [0236.568] CloseHandle (hObject=0x370) returned 1 [0236.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0236.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.568] SetEvent (hEvent=0x2ec) returned 1 [0236.568] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.569] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2950) returned 1 [0236.569] CloseHandle (hObject=0x370) returned 1 [0236.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0236.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.569] SetEvent (hEvent=0x2ec) returned 1 [0236.569] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.570] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=237) returned 1 [0236.570] CloseHandle (hObject=0x370) returned 1 [0236.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0236.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.570] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.570] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=6381) returned 1 [0236.570] CloseHandle (hObject=0x370) returned 1 [0236.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0236.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.571] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.571] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=232) returned 1 [0236.572] CloseHandle (hObject=0x370) returned 1 [0236.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0236.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.572] SetEvent (hEvent=0x2ec) returned 1 [0236.572] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.573] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=5115) returned 1 [0236.573] CloseHandle (hObject=0x370) returned 1 [0236.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0236.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.573] SetEvent (hEvent=0x2ec) returned 1 [0236.573] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.573] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=3981) returned 1 [0236.573] CloseHandle (hObject=0x370) returned 1 [0236.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0236.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.574] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.574] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=5115) returned 1 [0236.574] CloseHandle (hObject=0x370) returned 1 [0236.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0236.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.574] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0236.685] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=14049) returned 1 [0236.697] CloseHandle (hObject=0x398) returned 1 [0236.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0236.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.697] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0236.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0236.989] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=19780) returned 1 [0236.989] CloseHandle (hObject=0x374) returned 1 [0236.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0236.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0236.990] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0236.990] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0236.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0236.990] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2f70) returned 1 [0236.990] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0236.990] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x4d44, lpOverlapped=0x0) returned 1 [0237.409] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4d50, dwBufLen=0x4d50 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4d50) returned 1 [0237.409] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x4d50, lpOverlapped=0x0) returned 1 [0237.410] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0237.410] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0237.410] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0237.410] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0237.410] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0237.410] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0237.411] CloseHandle (hObject=0x374) returned 1 [0237.411] CloseHandle (hObject=0x340) returned 1 [0237.411] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0237.412] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0237.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0237.977] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=34916) returned 1 [0237.977] CloseHandle (hObject=0x380) returned 1 [0237.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0237.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0237.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0237.978] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0237.978] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0237.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0237.978] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0237.978] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0237.978] ReadFile (in: hFile=0x380, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x8864, lpOverlapped=0x0) returned 1 [0238.018] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x8870, dwBufLen=0x8870 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x8870) returned 1 [0238.018] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x8870, lpOverlapped=0x0) returned 1 [0238.021] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0238.021] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.022] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.022] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.022] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.022] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.022] CloseHandle (hObject=0x380) returned 1 [0238.022] CloseHandle (hObject=0x340) returned 1 [0238.023] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0238.024] SetEvent (hEvent=0x2ec) returned 1 [0238.024] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.028] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2181) returned 1 [0238.028] CloseHandle (hObject=0x374) returned 1 [0238.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0238.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.029] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.029] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.040] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0238.045] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.045] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x885, lpOverlapped=0x0) returned 1 [0238.067] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x890, dwBufLen=0x890 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x890) returned 1 [0238.068] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x890, lpOverlapped=0x0) returned 1 [0238.069] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0238.069] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.069] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.069] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.069] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.069] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.069] CloseHandle (hObject=0x374) returned 1 [0238.069] CloseHandle (hObject=0x398) returned 1 [0238.069] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0238.070] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.405] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=31837) returned 1 [0238.405] CloseHandle (hObject=0x374) returned 1 [0238.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0238.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.406] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.406] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.406] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2f70) returned 1 [0238.406] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.406] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x7c5d, lpOverlapped=0x0) returned 1 [0238.427] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x7c60, dwBufLen=0x7c60 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x7c60) returned 1 [0238.427] WriteFile (in: hFile=0x380, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x7c60, lpOverlapped=0x0) returned 1 [0238.430] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0238.431] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.431] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.431] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.431] WriteFile (in: hFile=0x380, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.431] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.431] CloseHandle (hObject=0x374) returned 1 [0238.431] CloseHandle (hObject=0x380) returned 1 [0238.432] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0238.433] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.562] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=43276) returned 1 [0238.562] CloseHandle (hObject=0x398) returned 1 [0238.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0238.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.563] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.563] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.563] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2f70) returned 1 [0238.563] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.563] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0xa90c, lpOverlapped=0x0) returned 1 [0238.630] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xa910, dwBufLen=0xa910 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xa910) returned 1 [0238.631] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xa910, lpOverlapped=0x0) returned 1 [0238.633] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0238.633] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.633] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.633] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.633] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.633] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.633] CloseHandle (hObject=0x398) returned 1 [0238.633] CloseHandle (hObject=0x374) returned 1 [0238.635] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0238.636] SetEvent (hEvent=0x2ec) returned 1 [0238.636] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.637] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=29925) returned 1 [0238.637] CloseHandle (hObject=0x374) returned 1 [0238.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0238.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.637] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.637] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.638] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2f70) returned 1 [0238.638] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.639] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x74e5, lpOverlapped=0x0) returned 1 [0238.648] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x74f0, dwBufLen=0x74f0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x74f0) returned 1 [0238.648] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x74f0, lpOverlapped=0x0) returned 1 [0238.650] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0238.650] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.650] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.650] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.650] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.650] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.650] CloseHandle (hObject=0x374) returned 1 [0238.650] CloseHandle (hObject=0x398) returned 1 [0238.652] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0238.653] SetEvent (hEvent=0x2ec) returned 1 [0238.653] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.654] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1363) returned 1 [0238.654] CloseHandle (hObject=0x398) returned 1 [0238.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0238.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.654] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.654] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.666] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2f70) returned 1 [0238.666] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.666] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x553, lpOverlapped=0x0) returned 1 [0238.685] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x560, dwBufLen=0x560 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x560) returned 1 [0238.685] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x560, lpOverlapped=0x0) returned 1 [0238.686] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0238.686] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.686] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.686] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0238.686] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.687] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.687] CloseHandle (hObject=0x398) returned 1 [0238.687] CloseHandle (hObject=0x374) returned 1 [0238.688] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0238.689] SetEvent (hEvent=0x2ec) returned 1 [0238.689] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.689] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=20371) returned 1 [0238.690] CloseHandle (hObject=0x374) returned 1 [0238.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0238.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.690] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.690] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.691] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2f70) returned 1 [0238.691] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.691] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x4f93, lpOverlapped=0x0) returned 1 [0238.693] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4fa0, dwBufLen=0x4fa0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4fa0) returned 1 [0238.694] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x4fa0, lpOverlapped=0x0) returned 1 [0238.695] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0238.695] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.696] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.696] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0238.696] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.696] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.696] CloseHandle (hObject=0x374) returned 1 [0238.696] CloseHandle (hObject=0x398) returned 1 [0238.697] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0238.698] SetEvent (hEvent=0x2ec) returned 1 [0238.698] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.699] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1293) returned 1 [0238.699] CloseHandle (hObject=0x398) returned 1 [0238.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0238.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.699] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.699] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.966] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0238.966] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.966] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x50d, lpOverlapped=0x0) returned 1 [0238.967] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x510, dwBufLen=0x510 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x510) returned 1 [0238.967] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x510, lpOverlapped=0x0) returned 1 [0238.968] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0238.968] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.968] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.968] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.968] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.969] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.969] CloseHandle (hObject=0x398) returned 1 [0238.969] CloseHandle (hObject=0x374) returned 1 [0238.970] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0238.970] SetEvent (hEvent=0x2ec) returned 1 [0238.970] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.971] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1287) returned 1 [0238.971] CloseHandle (hObject=0x374) returned 1 [0238.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0238.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.971] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.971] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.973] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0238.973] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.973] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x507, lpOverlapped=0x0) returned 1 [0238.974] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x510, dwBufLen=0x510 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x510) returned 1 [0238.974] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x510, lpOverlapped=0x0) returned 1 [0238.975] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0238.975] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.976] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.976] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.976] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.976] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.976] CloseHandle (hObject=0x374) returned 1 [0238.976] CloseHandle (hObject=0x398) returned 1 [0238.976] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0238.977] SetEvent (hEvent=0x2ec) returned 1 [0238.977] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.978] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=28595) returned 1 [0238.978] CloseHandle (hObject=0x398) returned 1 [0238.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0238.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.978] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.978] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.979] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0238.979] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.979] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x6fb3, lpOverlapped=0x0) returned 1 [0238.982] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x6fc0, dwBufLen=0x6fc0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x6fc0) returned 1 [0238.983] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x6fc0, lpOverlapped=0x0) returned 1 [0238.984] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2ef0) returned 1 [0238.984] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.984] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.984] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0238.984] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.984] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.984] CloseHandle (hObject=0x398) returned 1 [0238.984] CloseHandle (hObject=0x374) returned 1 [0238.985] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0238.986] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.986] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=3957) returned 1 [0238.987] CloseHandle (hObject=0x374) returned 1 [0238.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0238.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.987] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.987] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.991] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0238.991] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.991] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0xf75, lpOverlapped=0x0) returned 1 [0238.992] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xf80, dwBufLen=0xf80 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xf80) returned 1 [0238.992] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf80, lpOverlapped=0x0) returned 1 [0238.993] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0238.993] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.993] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0238.993] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.993] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0238.993] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0238.993] CloseHandle (hObject=0x374) returned 1 [0238.993] CloseHandle (hObject=0x398) returned 1 [0238.995] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0238.996] SetEvent (hEvent=0x2ec) returned 1 [0238.996] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0238.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.997] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=33277) returned 1 [0238.997] CloseHandle (hObject=0x398) returned 1 [0238.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0238.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.998] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.998] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0238.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0238.998] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0238.998] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0238.998] ReadFile (in: hFile=0x398, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x81fd, lpOverlapped=0x0) returned 1 [0239.000] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x8200, dwBufLen=0x8200 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x8200) returned 1 [0239.001] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x8200, lpOverlapped=0x0) returned 1 [0239.002] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0239.002] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0239.002] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0239.002] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0239.002] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0239.002] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.003] CloseHandle (hObject=0x398) returned 1 [0239.003] CloseHandle (hObject=0x374) returned 1 [0239.004] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0239.005] SetEvent (hEvent=0x2ec) returned 1 [0239.005] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0239.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0239.006] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1453) returned 1 [0239.006] CloseHandle (hObject=0x374) returned 1 [0239.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0239.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0239.006] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0239.006] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0239.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0239.173] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0239.173] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0239.173] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x5ad, lpOverlapped=0x0) returned 1 [0239.218] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5b0) returned 1 [0239.218] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x5b0, lpOverlapped=0x0) returned 1 [0239.220] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0239.220] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0239.220] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0239.220] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0239.220] WriteFile (in: hFile=0x398, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0239.220] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.220] CloseHandle (hObject=0x374) returned 1 [0239.220] CloseHandle (hObject=0x398) returned 1 [0239.221] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0239.222] SetEvent (hEvent=0x2ec) returned 1 [0239.222] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0239.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0240.435] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1347) returned 1 [0240.435] CloseHandle (hObject=0x348) returned 1 [0240.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0240.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0240.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0240.436] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0240.436] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0240.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0240.437] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2f70) returned 1 [0240.437] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0240.437] ReadFile (in: hFile=0x348, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x543, lpOverlapped=0x0) returned 1 [0240.898] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x550, dwBufLen=0x550 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x550) returned 1 [0240.898] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x550, lpOverlapped=0x0) returned 1 [0240.899] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2e70) returned 1 [0240.899] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0240.899] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0240.899] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0240.899] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0240.899] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0240.899] CloseHandle (hObject=0x348) returned 1 [0240.899] CloseHandle (hObject=0x340) returned 1 [0240.901] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0240.902] SetEvent (hEvent=0x2ec) returned 1 [0240.902] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0240.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0240.903] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=5120) returned 1 [0240.903] CloseHandle (hObject=0x340) returned 1 [0240.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0240.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0240.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0240.903] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0240.903] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0240.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.008] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0241.008] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.008] ReadFile (in: hFile=0x340, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x1400, lpOverlapped=0x0) returned 1 [0241.009] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1410, dwBufLen=0x1410 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1410) returned 1 [0241.010] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x1410, lpOverlapped=0x0) returned 1 [0241.010] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0241.010] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.011] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.011] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.011] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.011] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.011] CloseHandle (hObject=0x340) returned 1 [0241.011] CloseHandle (hObject=0x374) returned 1 [0241.016] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0241.017] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.017] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2552) returned 1 [0241.017] CloseHandle (hObject=0x374) returned 1 [0241.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0241.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.017] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.017] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.020] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0241.020] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.020] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x9f8, lpOverlapped=0x0) returned 1 [0241.021] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xa00, dwBufLen=0xa00 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xa00) returned 1 [0241.021] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xa00, lpOverlapped=0x0) returned 1 [0241.022] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0241.022] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.022] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.023] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.023] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.023] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.023] CloseHandle (hObject=0x374) returned 1 [0241.023] CloseHandle (hObject=0x390) returned 1 [0241.027] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0241.028] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.029] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=18817) returned 1 [0241.029] CloseHandle (hObject=0x390) returned 1 [0241.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0241.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.029] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.029] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.029] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0241.030] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.030] ReadFile (in: hFile=0x390, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x4981, lpOverlapped=0x0) returned 1 [0241.031] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4990, dwBufLen=0x4990 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4990) returned 1 [0241.031] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x4990, lpOverlapped=0x0) returned 1 [0241.032] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0241.032] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.032] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.032] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.032] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.033] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.033] CloseHandle (hObject=0x390) returned 1 [0241.033] CloseHandle (hObject=0x374) returned 1 [0241.035] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0241.036] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.037] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=5179) returned 1 [0241.037] CloseHandle (hObject=0x374) returned 1 [0241.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0241.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.037] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.037] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.260] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2ef0) returned 1 [0241.265] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.265] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x143b, lpOverlapped=0x0) returned 1 [0241.266] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1440, dwBufLen=0x1440 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x1440) returned 1 [0241.266] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x1440, lpOverlapped=0x0) returned 1 [0241.267] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2cb0) returned 1 [0241.267] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.267] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.267] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.267] WriteFile (in: hFile=0x340, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.268] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.268] CloseHandle (hObject=0x374) returned 1 [0241.268] CloseHandle (hObject=0x340) returned 1 [0241.268] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0241.269] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.927] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=19485) returned 1 [0241.927] CloseHandle (hObject=0x390) returned 1 [0241.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0241.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.927] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.927] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.928] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0241.928] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.928] ReadFile (in: hFile=0x390, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x4c1d, lpOverlapped=0x0) returned 1 [0241.929] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x4c20) returned 1 [0241.929] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x4c20, lpOverlapped=0x0) returned 1 [0241.931] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.931] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.931] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.931] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.931] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.931] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.931] CloseHandle (hObject=0x390) returned 1 [0241.931] CloseHandle (hObject=0x374) returned 1 [0241.932] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0241.933] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.934] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=18413) returned 1 [0241.934] CloseHandle (hObject=0x374) returned 1 [0241.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0241.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.934] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.934] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.935] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0241.935] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.935] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x47ed, lpOverlapped=0x0) returned 1 [0241.938] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x47f0) returned 1 [0241.938] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x47f0, lpOverlapped=0x0) returned 1 [0241.940] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.940] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.940] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.940] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.940] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.940] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.940] CloseHandle (hObject=0x374) returned 1 [0241.940] CloseHandle (hObject=0x390) returned 1 [0241.940] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0241.941] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.941] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1659) returned 1 [0241.941] CloseHandle (hObject=0x390) returned 1 [0241.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0241.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.942] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.942] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.944] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0241.944] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.944] ReadFile (in: hFile=0x390, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x67b, lpOverlapped=0x0) returned 1 [0241.945] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x680, dwBufLen=0x680 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x680) returned 1 [0241.945] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x680, lpOverlapped=0x0) returned 1 [0241.946] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.946] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.946] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.946] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.946] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.946] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.946] CloseHandle (hObject=0x390) returned 1 [0241.946] CloseHandle (hObject=0x374) returned 1 [0241.947] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0241.947] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.948] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=44850) returned 1 [0241.948] CloseHandle (hObject=0x374) returned 1 [0241.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0241.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.949] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.949] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.949] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0241.949] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.949] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0xaf32, lpOverlapped=0x0) returned 1 [0241.951] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xaf40, dwBufLen=0xaf40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xaf40) returned 1 [0241.951] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xaf40, lpOverlapped=0x0) returned 1 [0241.952] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.952] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.953] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.953] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.953] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.953] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.953] CloseHandle (hObject=0x374) returned 1 [0241.953] CloseHandle (hObject=0x390) returned 1 [0241.953] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0241.954] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.955] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1379) returned 1 [0241.955] CloseHandle (hObject=0x390) returned 1 [0241.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0241.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.955] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.955] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.957] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0241.957] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.957] ReadFile (in: hFile=0x390, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x563, lpOverlapped=0x0) returned 1 [0241.958] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x570, dwBufLen=0x570 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x570) returned 1 [0241.958] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x570, lpOverlapped=0x0) returned 1 [0241.960] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.960] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.960] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.960] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.960] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.960] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.960] CloseHandle (hObject=0x390) returned 1 [0241.960] CloseHandle (hObject=0x374) returned 1 [0241.961] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0241.962] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.962] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=48115) returned 1 [0241.962] CloseHandle (hObject=0x374) returned 1 [0241.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0241.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.962] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.962] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.963] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0241.963] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.963] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0xbbf3, lpOverlapped=0x0) returned 1 [0241.966] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xbc00, dwBufLen=0xbc00 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xbc00) returned 1 [0241.966] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xbc00, lpOverlapped=0x0) returned 1 [0241.968] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.968] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.968] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.968] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.968] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.968] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.968] CloseHandle (hObject=0x374) returned 1 [0241.968] CloseHandle (hObject=0x390) returned 1 [0241.968] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0241.969] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.971] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1364) returned 1 [0241.971] CloseHandle (hObject=0x390) returned 1 [0241.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0241.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.971] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.971] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.973] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0241.973] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.973] ReadFile (in: hFile=0x390, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x554, lpOverlapped=0x0) returned 1 [0241.974] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x560, dwBufLen=0x560 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x560) returned 1 [0241.974] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x560, lpOverlapped=0x0) returned 1 [0241.975] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.975] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.975] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.976] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.976] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.976] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.976] CloseHandle (hObject=0x390) returned 1 [0241.976] CloseHandle (hObject=0x374) returned 1 [0241.976] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0241.977] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.977] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=11573) returned 1 [0241.977] CloseHandle (hObject=0x374) returned 1 [0241.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0241.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.978] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.978] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.978] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2cb0) returned 1 [0241.978] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.978] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x2d35, lpOverlapped=0x0) returned 1 [0241.981] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x2d40) returned 1 [0241.981] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x2d40, lpOverlapped=0x0) returned 1 [0241.982] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2eb0) returned 1 [0241.982] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.982] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.982] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0241.982] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.982] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.982] CloseHandle (hObject=0x374) returned 1 [0241.982] CloseHandle (hObject=0x390) returned 1 [0241.983] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0241.984] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.984] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=2574) returned 1 [0241.984] CloseHandle (hObject=0x390) returned 1 [0241.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0241.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.984] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.984] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.986] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0241.986] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.986] ReadFile (in: hFile=0x390, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0xa0e, lpOverlapped=0x0) returned 1 [0241.987] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0xa10, dwBufLen=0xa10 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0xa10) returned 1 [0241.988] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xa10, lpOverlapped=0x0) returned 1 [0241.988] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.988] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.988] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.988] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.988] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.989] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0241.989] CloseHandle (hObject=0x390) returned 1 [0241.989] CloseHandle (hObject=0x374) returned 1 [0241.989] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0241.990] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.990] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=37440) returned 1 [0241.990] CloseHandle (hObject=0x374) returned 1 [0241.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0241.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.990] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.990] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.991] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0241.991] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.991] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x9240, lpOverlapped=0x0) returned 1 [0241.992] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x9250, dwBufLen=0x9250 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x9250) returned 1 [0241.993] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x9250, lpOverlapped=0x0) returned 1 [0241.994] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0241.994] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.994] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0241.994] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.994] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0241.994] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0241.994] CloseHandle (hObject=0x374) returned 1 [0241.994] CloseHandle (hObject=0x390) returned 1 [0241.995] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0241.996] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0241.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.996] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1593) returned 1 [0241.996] CloseHandle (hObject=0x390) returned 1 [0241.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0241.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.996] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.996] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0241.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0241.998] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0241.998] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0241.998] ReadFile (in: hFile=0x390, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x639, lpOverlapped=0x0) returned 1 [0242.000] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x640, dwBufLen=0x640 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x640) returned 1 [0242.000] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x640, lpOverlapped=0x0) returned 1 [0242.000] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0242.001] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0242.001] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0242.001] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0242.001] WriteFile (in: hFile=0x374, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0242.001] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.001] CloseHandle (hObject=0x390) returned 1 [0242.001] CloseHandle (hObject=0x374) returned 1 [0242.001] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0242.002] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0242.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0242.003] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=21745) returned 1 [0242.003] CloseHandle (hObject=0x374) returned 1 [0242.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0242.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0242.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0242.003] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0242.003] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0242.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.003] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0242.004] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0242.004] ReadFile (in: hFile=0x374, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x54f1, lpOverlapped=0x0) returned 1 [0242.005] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5500, dwBufLen=0x5500 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x5500) returned 1 [0242.005] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x5500, lpOverlapped=0x0) returned 1 [0242.006] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0242.006] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0242.006] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0242.006] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0242.006] WriteFile (in: hFile=0x390, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0242.007] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.007] CloseHandle (hObject=0x374) returned 1 [0242.007] CloseHandle (hObject=0x390) returned 1 [0242.007] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0242.008] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0242.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.008] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x31afce0 | out: lpFileSize=0x31afce0*=1339) returned 1 [0242.008] CloseHandle (hObject=0x390) returned 1 [0242.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0242.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0242.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.009] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0242.009] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afc80 | out: lpNewFilePointer=0x0) returned 1 [0242.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0242.111] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc94 | out: phKey=0x31afc94*=0x5a2eb0) returned 1 [0242.111] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0242.111] ReadFile (in: hFile=0x390, lpBuffer=0x3820020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afcbc, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesRead=0x31afcbc*=0x53b, lpOverlapped=0x0) returned 1 [0242.113] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x540, dwBufLen=0x540 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x540) returned 1 [0242.113] WriteFile (in: hFile=0x380, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0x540, lpOverlapped=0x0) returned 1 [0242.114] CryptImportKey (in: hProv=0x5a37b8, pbData=0x31afc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afc98 | out: phKey=0x31afc98*=0x5a2f70) returned 1 [0242.114] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x31afd48, dwFlags=0x0) returned 1 [0242.114] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40, dwBufLen=0x40 | out: pbData=0x3820020*, pdwDataLen=0x31afc58*=0x40) returned 1 [0242.114] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0242.114] WriteFile (in: hFile=0x380, lpBuffer=0x3820020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afca0, lpOverlapped=0x0 | out: lpBuffer=0x3820020*, lpNumberOfBytesWritten=0x31afca0*=0xf2, lpOverlapped=0x0) returned 1 [0242.121] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.121] CloseHandle (hObject=0x390) returned 1 [0242.121] CloseHandle (hObject=0x380) returned 1 [0242.121] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0242.123] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x31afd48 | out: pbBuffer=0x31afd48) returned 1 [0242.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 102 os_tid = 0x974 [0223.800] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x3630050 [0223.801] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x3640058 [0223.801] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x297f30 [0223.801] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x110102) returned 0x3940020 [0223.801] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x50) returned 0x297f60 [0223.801] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffbd8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffc40 | out: phKey=0x34ffc40*=0x5a2d30) returned 1 [0223.801] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x34ffc28, dwFlags=0x0) returned 1 [0223.801] CryptDecrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x297f60, pdwDataLen=0x34ffbf4 | out: pbData=0x297f60, pdwDataLen=0x34ffbf4) returned 1 [0223.801] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0223.802] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0223.802] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0223.802] Wow64DisableWow64FsRedirection (in: OldValue=0x34ffc90 | out: OldValue=0x34ffc90*=0x0) returned 1 [0223.802] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x297f60 | out: hHeap=0x290000) returned 1 [0223.802] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0223.802] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0224.171] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=1984228) returned 1 [0224.172] CloseHandle (hObject=0x33c) returned 1 [0224.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0224.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0224.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0224.172] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0224.172] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0224.201] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=2506240) returned 1 [0224.201] CloseHandle (hObject=0x34c) returned 1 [0224.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0224.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0224.208] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0224.208] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0224.208] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0224.208] ReadFile (in: hFile=0x34c, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0224.398] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0224.398] ReadFile (in: hFile=0x34c, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0224.418] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0224.418] ReadFile (in: hFile=0x34c, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0224.471] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2f70) returned 1 [0224.471] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0224.471] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060) returned 1 [0226.963] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0226.963] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0226.963] WriteFile (in: hFile=0x34c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0112, lpOverlapped=0x0) returned 1 [0226.986] SetEndOfFile (hFile=0x34c) returned 1 [0226.990] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0226.990] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0226.993] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0226.993] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0226.998] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0226.998] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0227.000] CloseHandle (hObject=0x34c) returned 1 [0227.453] SetEvent (hEvent=0x2d4) returned 1 [0227.454] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0227.454] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0227.455] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=2503680) returned 1 [0227.455] CloseHandle (hObject=0x340) returned 1 [0227.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0227.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0227.455] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0227.455] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0227.455] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0227.455] ReadFile (in: hFile=0x340, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0227.460] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0227.460] ReadFile (in: hFile=0x340, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0227.623] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0227.623] ReadFile (in: hFile=0x340, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0227.631] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2db0) returned 1 [0227.631] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0227.631] CryptEncrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060) returned 1 [0227.641] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.641] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0227.641] WriteFile (in: hFile=0x340, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0112, lpOverlapped=0x0) returned 1 [0227.744] SetEndOfFile (hFile=0x340) returned 1 [0227.744] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0227.744] WriteFile (in: hFile=0x340, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0227.747] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0227.747] WriteFile (in: hFile=0x340, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0227.752] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0227.752] WriteFile (in: hFile=0x340, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0227.754] CloseHandle (hObject=0x340) returned 1 [0229.452] SetEvent (hEvent=0x2d4) returned 1 [0229.477] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0229.531] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0229.548] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=2513920) returned 1 [0229.551] CloseHandle (hObject=0x340) returned 1 [0229.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0229.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0229.567] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0229.567] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0229.567] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0229.567] ReadFile (in: hFile=0x340, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0229.572] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0229.572] ReadFile (in: hFile=0x340, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0229.581] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0229.581] ReadFile (in: hFile=0x340, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0229.588] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2ef0) returned 1 [0229.588] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0229.588] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060) returned 1 [0230.349] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0230.349] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0230.349] WriteFile (in: hFile=0x340, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0112, lpOverlapped=0x0) returned 1 [0230.366] SetEndOfFile (hFile=0x340) returned 1 [0230.367] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0230.367] WriteFile (in: hFile=0x340, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0230.369] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0230.369] WriteFile (in: hFile=0x340, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0230.373] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0230.373] WriteFile (in: hFile=0x340, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0230.374] CloseHandle (hObject=0x340) returned 1 [0231.092] SetEvent (hEvent=0x2d4) returned 1 [0231.096] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0231.096] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0231.096] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=9958388) returned 1 [0231.096] CloseHandle (hObject=0x340) returned 1 [0231.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0231.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0231.097] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0231.097] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0231.097] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0231.097] ReadFile (in: hFile=0x340, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0231.100] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0231.100] ReadFile (in: hFile=0x340, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0231.107] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0231.108] ReadFile (in: hFile=0x340, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0231.116] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2e70) returned 1 [0231.116] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0231.116] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0050) returned 1 [0231.122] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.123] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0231.123] WriteFile (in: hFile=0x340, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0102, lpOverlapped=0x0) returned 1 [0231.234] SetEndOfFile (hFile=0x340) returned 1 [0231.234] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0231.234] WriteFile (in: hFile=0x340, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0231.236] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0231.236] WriteFile (in: hFile=0x340, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0231.240] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0231.240] WriteFile (in: hFile=0x340, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0231.242] CloseHandle (hObject=0x340) returned 1 [0234.052] SetEvent (hEvent=0x2d4) returned 1 [0234.052] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0234.052] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.052] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=2865664) returned 1 [0234.052] CloseHandle (hObject=0x380) returned 1 [0234.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0234.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0234.053] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.053] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0234.053] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0234.053] ReadFile (in: hFile=0x380, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0234.056] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0234.056] ReadFile (in: hFile=0x380, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0234.066] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0234.066] ReadFile (in: hFile=0x380, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0234.071] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2f70) returned 1 [0234.071] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0234.072] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060) returned 1 [0234.078] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.078] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0234.078] WriteFile (in: hFile=0x380, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0112, lpOverlapped=0x0) returned 1 [0234.095] SetEndOfFile (hFile=0x380) returned 1 [0234.095] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0234.095] WriteFile (in: hFile=0x380, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0234.097] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0234.097] WriteFile (in: hFile=0x380, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0234.195] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0234.195] WriteFile (in: hFile=0x380, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0234.197] CloseHandle (hObject=0x380) returned 1 [0234.504] SetEvent (hEvent=0x2d4) returned 1 [0234.504] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0234.504] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.505] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=43806141) returned 1 [0234.505] CloseHandle (hObject=0x380) returned 1 [0234.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0234.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0234.505] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.506] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0234.506] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0234.506] ReadFile (in: hFile=0x380, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0234.510] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0234.510] ReadFile (in: hFile=0x380, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0234.589] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0234.589] ReadFile (in: hFile=0x380, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0234.607] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2f70) returned 1 [0234.607] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0234.608] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0050) returned 1 [0234.614] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.614] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0234.614] WriteFile (in: hFile=0x380, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0102, lpOverlapped=0x0) returned 1 [0234.628] SetEndOfFile (hFile=0x380) returned 1 [0234.628] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0234.628] WriteFile (in: hFile=0x380, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0234.630] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0234.631] WriteFile (in: hFile=0x380, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0234.633] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0234.633] WriteFile (in: hFile=0x380, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0234.634] CloseHandle (hObject=0x380) returned 1 [0236.985] SetEvent (hEvent=0x2d4) returned 1 [0236.986] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0236.986] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0236.986] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=875520) returned 1 [0236.986] CloseHandle (hObject=0x390) returned 1 [0236.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0236.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.986] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0236.986] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd0 | out: lpNewFilePointer=0x0) returned 1 [0236.986] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd0 | out: lpNewFilePointer=0x0) returned 1 [0236.986] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0236.987] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb88, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbe4 | out: phKey=0x34ffbe4*=0x5a2eb0) returned 1 [0236.987] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0236.987] ReadFile (in: hFile=0x390, lpBuffer=0x3940020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x34ffc0c*=0xd5c00, lpOverlapped=0x0) returned 1 [0237.420] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffba8*=0xd5c10, dwBufLen=0xd5c10 | out: pbData=0x3940020*, pdwDataLen=0x34ffba8*=0xd5c10) returned 1 [0237.427] WriteFile (in: hFile=0x380, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x34ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbf0*=0xd5c10, lpOverlapped=0x0) returned 1 [0237.441] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbe8 | out: phKey=0x34ffbe8*=0x5a2f70) returned 1 [0237.441] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0237.441] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffba8*=0x40, dwBufLen=0x40 | out: pbData=0x3940020*, pdwDataLen=0x34ffba8*=0x40) returned 1 [0237.441] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0237.441] WriteFile (in: hFile=0x380, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbf0*=0xf2, lpOverlapped=0x0) returned 1 [0237.441] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0237.441] CloseHandle (hObject=0x390) returned 1 [0237.441] CloseHandle (hObject=0x380) returned 1 [0237.448] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0237.710] SetEvent (hEvent=0x2d4) returned 1 [0237.710] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0237.710] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0237.713] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=13642474) returned 1 [0237.713] CloseHandle (hObject=0x390) returned 1 [0237.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0237.713] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0237.876] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0237.876] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0237.876] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0237.876] ReadFile (in: hFile=0x390, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0237.880] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0237.880] ReadFile (in: hFile=0x390, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0237.886] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0237.886] ReadFile (in: hFile=0x390, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0237.894] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2eb0) returned 1 [0237.894] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0237.895] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0050) returned 1 [0237.901] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0237.901] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0237.901] WriteFile (in: hFile=0x390, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0102, lpOverlapped=0x0) returned 1 [0237.914] SetEndOfFile (hFile=0x390) returned 1 [0237.914] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0237.914] WriteFile (in: hFile=0x390, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0237.916] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0237.916] WriteFile (in: hFile=0x390, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0237.917] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0237.917] WriteFile (in: hFile=0x390, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0237.917] CloseHandle (hObject=0x390) returned 1 [0239.122] SetEvent (hEvent=0x2d4) returned 1 [0239.123] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0239.123] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.123] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=885760) returned 1 [0239.123] CloseHandle (hObject=0x390) returned 1 [0239.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0239.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.123] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.124] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd0 | out: lpNewFilePointer=0x0) returned 1 [0239.124] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd0 | out: lpNewFilePointer=0x0) returned 1 [0239.124] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0239.124] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb88, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbe4 | out: phKey=0x34ffbe4*=0x5a2ef0) returned 1 [0239.124] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0239.124] ReadFile (in: hFile=0x390, lpBuffer=0x3940020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x34ffc0c*=0xd8400, lpOverlapped=0x0) returned 1 [0239.136] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffba8*=0xd8410, dwBufLen=0xd8410 | out: pbData=0x3940020*, pdwDataLen=0x34ffba8*=0xd8410) returned 1 [0239.144] WriteFile (in: hFile=0x398, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x34ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbf0*=0xd8410, lpOverlapped=0x0) returned 1 [0239.158] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbe8 | out: phKey=0x34ffbe8*=0x5a2cb0) returned 1 [0239.158] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0239.158] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffba8*=0x40, dwBufLen=0x40 | out: pbData=0x3940020*, pdwDataLen=0x34ffba8*=0x40) returned 1 [0239.158] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0239.158] WriteFile (in: hFile=0x398, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbf0*=0xf2, lpOverlapped=0x0) returned 1 [0239.158] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.158] CloseHandle (hObject=0x390) returned 1 [0239.159] CloseHandle (hObject=0x398) returned 1 [0239.166] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0239.262] SetEvent (hEvent=0x2d4) returned 1 [0239.262] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0239.262] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0239.263] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=868864) returned 1 [0239.263] CloseHandle (hObject=0x398) returned 1 [0239.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0239.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.263] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0239.263] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd0 | out: lpNewFilePointer=0x0) returned 1 [0239.263] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd0 | out: lpNewFilePointer=0x0) returned 1 [0239.263] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0239.263] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb88, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbe4 | out: phKey=0x34ffbe4*=0x5a2ef0) returned 1 [0239.263] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0239.263] ReadFile (in: hFile=0x398, lpBuffer=0x3940020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x34ffc0c*=0xd4200, lpOverlapped=0x0) returned 1 [0239.271] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffba8*=0xd4210, dwBufLen=0xd4210 | out: pbData=0x3940020*, pdwDataLen=0x34ffba8*=0xd4210) returned 1 [0239.278] WriteFile (in: hFile=0x374, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x34ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbf0*=0xd4210, lpOverlapped=0x0) returned 1 [0240.439] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbe8 | out: phKey=0x34ffbe8*=0x5a2e70) returned 1 [0240.439] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0240.439] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffba8*=0x40, dwBufLen=0x40 | out: pbData=0x3940020*, pdwDataLen=0x34ffba8*=0x40) returned 1 [0240.439] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0240.439] WriteFile (in: hFile=0x374, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbf0*=0xf2, lpOverlapped=0x0) returned 1 [0240.828] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0240.828] CloseHandle (hObject=0x398) returned 1 [0240.828] CloseHandle (hObject=0x374) returned 1 [0240.878] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0240.887] SetEvent (hEvent=0x2d4) returned 1 [0240.887] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0240.887] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0240.888] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=873984) returned 1 [0240.888] CloseHandle (hObject=0x374) returned 1 [0240.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0240.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0240.888] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0240.888] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd0 | out: lpNewFilePointer=0x0) returned 1 [0240.888] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd0 | out: lpNewFilePointer=0x0) returned 1 [0240.888] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0240.888] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb88, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbe4 | out: phKey=0x34ffbe4*=0x5a2ef0) returned 1 [0240.889] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0240.889] ReadFile (in: hFile=0x374, lpBuffer=0x3940020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x34ffc0c*=0xd5600, lpOverlapped=0x0) returned 1 [0240.969] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffba8*=0xd5610, dwBufLen=0xd5610 | out: pbData=0x3940020*, pdwDataLen=0x34ffba8*=0xd5610) returned 1 [0240.977] WriteFile (in: hFile=0x398, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x34ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbf0*=0xd5610, lpOverlapped=0x0) returned 1 [0240.992] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbe8 | out: phKey=0x34ffbe8*=0x5a2cb0) returned 1 [0240.992] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0240.993] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffba8*=0x40, dwBufLen=0x40 | out: pbData=0x3940020*, pdwDataLen=0x34ffba8*=0x40) returned 1 [0240.993] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0240.993] WriteFile (in: hFile=0x398, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbf0*=0xf2, lpOverlapped=0x0) returned 1 [0240.993] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0240.993] CloseHandle (hObject=0x374) returned 1 [0240.993] CloseHandle (hObject=0x398) returned 1 [0241.045] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0241.053] SetEvent (hEvent=0x2d4) returned 1 [0241.054] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0241.054] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0241.054] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=2928955) returned 1 [0241.054] CloseHandle (hObject=0x398) returned 1 [0241.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0241.054] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0241.055] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0241.055] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0241.055] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0241.055] ReadFile (in: hFile=0x398, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0241.153] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0241.153] ReadFile (in: hFile=0x398, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0241.172] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0241.172] ReadFile (in: hFile=0x398, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0241.328] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2ef0) returned 1 [0241.328] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0241.328] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060) returned 1 [0241.335] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.335] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0241.335] WriteFile (in: hFile=0x398, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0112, lpOverlapped=0x0) returned 1 [0241.354] SetEndOfFile (hFile=0x398) returned 1 [0241.354] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0241.354] WriteFile (in: hFile=0x398, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.357] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0241.357] WriteFile (in: hFile=0x398, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.360] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0241.360] WriteFile (in: hFile=0x398, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.368] CloseHandle (hObject=0x398) returned 1 [0241.369] SetEvent (hEvent=0x2d4) returned 1 [0241.369] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0241.369] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0241.369] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=3124224) returned 1 [0241.369] CloseHandle (hObject=0x398) returned 1 [0241.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0241.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0241.370] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0241.370] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0241.370] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0241.370] ReadFile (in: hFile=0x398, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0241.424] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0241.424] ReadFile (in: hFile=0x398, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0241.817] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0241.817] ReadFile (in: hFile=0x398, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0241.845] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2ef0) returned 1 [0241.845] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0241.845] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060) returned 1 [0241.854] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.854] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0241.854] WriteFile (in: hFile=0x398, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0112, lpOverlapped=0x0) returned 1 [0241.875] SetEndOfFile (hFile=0x398) returned 1 [0241.875] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0241.875] WriteFile (in: hFile=0x398, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.878] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0241.878] WriteFile (in: hFile=0x398, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.881] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0241.881] WriteFile (in: hFile=0x398, lpBuffer=0x3a0014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0014a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0241.882] CloseHandle (hObject=0x398) returned 1 [0241.882] SetEvent (hEvent=0x2d4) returned 1 [0241.883] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0242.075] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.075] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=50823389) returned 1 [0242.075] CloseHandle (hObject=0x39c) returned 1 [0242.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0242.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0242.076] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.076] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0242.076] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0242.076] ReadFile (in: hFile=0x39c, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0242.093] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0242.093] ReadFile (in: hFile=0x39c, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0242.133] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0242.133] ReadFile (in: hFile=0x39c, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0242.143] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2eb0) returned 1 [0242.143] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0242.143] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0050) returned 1 [0242.152] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.152] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0242.152] WriteFile (in: hFile=0x39c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x34ffbe8*=0xc0102, lpOverlapped=0x0) returned 1 [0242.169] SetEndOfFile (hFile=0x39c) returned 1 [0242.169] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0242.169] WriteFile (in: hFile=0x39c, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0242.171] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0242.171] WriteFile (in: hFile=0x39c, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0242.172] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba8 | out: lpNewFilePointer=0x0) returned 1 [0242.172] WriteFile (in: hFile=0x39c, lpBuffer=0x3a0013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x3a0013a*, lpNumberOfBytesWritten=0x34ffbb4*=0x40000, lpOverlapped=0x0) returned 1 [0242.173] CloseHandle (hObject=0x39c) returned 1 [0242.173] SetEvent (hEvent=0x2d4) returned 1 [0242.173] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x34ffc98 | out: pbBuffer=0x34ffc98) returned 1 [0242.173] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.174] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x34ffc30 | out: lpFileSize=0x34ffc30*=2503680) returned 1 [0242.174] CloseHandle (hObject=0x39c) returned 1 [0242.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0242.174] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 1 [0242.174] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.174] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0242.174] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0242.174] ReadFile (in: hFile=0x39c, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0242.256] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0242.256] ReadFile (in: hFile=0x39c, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0242.276] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x34ffba0 | out: lpNewFilePointer=0x0) returned 1 [0242.276] ReadFile (in: hFile=0x39c, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffbac, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x34ffbac*=0x40000, lpOverlapped=0x0) returned 1 [0242.282] CryptImportKey (in: hProv=0x5a37b8, pbData=0x34ffb90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffbfc | out: phKey=0x34ffbfc*=0x5a2eb0) returned 1 [0242.282] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x34ffc98, dwFlags=0x0) returned 1 [0242.282] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3940020*, pdwDataLen=0x34ffbb0*=0xc0060) returned 1 [0242.289] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffbd8 | out: lpNewFilePointer=0x0) returned 1 [0242.289] WriteFile (hFile=0x39c, lpBuffer=0x3940020, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34ffbe8, lpOverlapped=0x0) Thread: id = 103 os_tid = 0x890 [0223.802] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x3650060 [0223.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x10000) returned 0x3660068 [0223.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x297f60 [0223.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x110102) returned 0x3a60020 [0223.803] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x50) returned 0x29de98 [0223.803] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fed0 | out: phKey=0x334fed0*=0x5a2d30) returned 1 [0223.803] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334feb8, dwFlags=0x0) returned 1 [0223.804] CryptDecrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29de98, pdwDataLen=0x334fe84 | out: pbData=0x29de98, pdwDataLen=0x334fe84) returned 1 [0223.804] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0223.804] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0223.804] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0223.804] Wow64DisableWow64FsRedirection (in: OldValue=0x334ff20 | out: OldValue=0x334ff20*=0x0) returned 1 [0223.804] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x290000) returned 1 [0223.804] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0223.804] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.804] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0223.804] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0224.170] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=65536) returned 1 [0224.170] CloseHandle (hObject=0x334) returned 1 [0224.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0224.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0224.170] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0224.170] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0224.170] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0224.171] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0224.182] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2df0) returned 1 [0224.183] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0224.183] ReadFile (in: hFile=0x334, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x10000, lpOverlapped=0x0) returned 1 [0224.212] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x10010, dwBufLen=0x10010 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x10010) returned 1 [0226.890] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x10010, lpOverlapped=0x0) returned 1 [0226.892] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0226.892] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0226.892] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0226.892] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0226.892] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0226.893] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0226.893] CloseHandle (hObject=0x334) returned 1 [0226.893] CloseHandle (hObject=0x344) returned 1 [0226.894] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0226.896] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0226.896] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0226.896] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1565) returned 1 [0226.896] CloseHandle (hObject=0x344) returned 1 [0226.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0226.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0226.897] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0226.897] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0226.897] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0226.897] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0226.897] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2df0) returned 1 [0226.897] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0226.897] ReadFile (in: hFile=0x344, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x61d, lpOverlapped=0x0) returned 1 [0226.938] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x620, dwBufLen=0x620 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x620) returned 1 [0226.938] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x620, lpOverlapped=0x0) returned 1 [0226.940] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0226.940] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0226.940] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0226.940] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0226.940] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0226.940] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0226.940] CloseHandle (hObject=0x344) returned 1 [0226.940] CloseHandle (hObject=0x334) returned 1 [0226.941] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0226.942] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0226.942] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0226.943] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2296) returned 1 [0226.943] CloseHandle (hObject=0x334) returned 1 [0226.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0226.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0226.943] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0226.943] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0226.943] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0226.943] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0226.943] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2df0) returned 1 [0226.943] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0226.943] ReadFile (in: hFile=0x334, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x8f8, lpOverlapped=0x0) returned 1 [0227.001] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x900, dwBufLen=0x900 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x900) returned 1 [0227.001] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x900, lpOverlapped=0x0) returned 1 [0227.005] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0227.005] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.005] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.005] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0227.005] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.005] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.005] CloseHandle (hObject=0x334) returned 1 [0227.005] CloseHandle (hObject=0x344) returned 1 [0227.006] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.008] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.008] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.008] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1886) returned 1 [0227.008] CloseHandle (hObject=0x344) returned 1 [0227.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.009] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.009] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.009] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.009] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.009] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2df0) returned 1 [0227.009] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.009] ReadFile (in: hFile=0x344, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x75e, lpOverlapped=0x0) returned 1 [0227.015] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x760, dwBufLen=0x760 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x760) returned 1 [0227.015] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x760, lpOverlapped=0x0) returned 1 [0227.016] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.016] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.016] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.016] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.016] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.016] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.016] CloseHandle (hObject=0x344) returned 1 [0227.016] CloseHandle (hObject=0x334) returned 1 [0227.017] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.018] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.018] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.020] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1450) returned 1 [0227.020] CloseHandle (hObject=0x334) returned 1 [0227.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0227.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.021] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.021] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.021] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.021] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.023] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2df0) returned 1 [0227.023] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.023] ReadFile (in: hFile=0x334, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5aa, lpOverlapped=0x0) returned 1 [0227.027] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5b0) returned 1 [0227.027] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5b0, lpOverlapped=0x0) returned 1 [0227.028] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.028] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.028] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50, dwBufLen=0x50 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50) returned 1 [0227.028] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.028] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x102, lpOverlapped=0x0) returned 1 [0227.029] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.029] CloseHandle (hObject=0x334) returned 1 [0227.029] CloseHandle (hObject=0x344) returned 1 [0227.030] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0227.031] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.031] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.031] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1608) returned 1 [0227.031] CloseHandle (hObject=0x344) returned 1 [0227.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.032] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.032] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.032] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.032] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.032] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2df0) returned 1 [0227.032] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.032] ReadFile (in: hFile=0x344, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x648, lpOverlapped=0x0) returned 1 [0227.034] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x650, dwBufLen=0x650 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x650) returned 1 [0227.034] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x650, lpOverlapped=0x0) returned 1 [0227.035] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.036] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.036] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.036] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.036] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.036] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.036] CloseHandle (hObject=0x344) returned 1 [0227.036] CloseHandle (hObject=0x334) returned 1 [0227.037] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.147] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.148] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.279] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2424) returned 1 [0227.279] CloseHandle (hObject=0x344) returned 1 [0227.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.279] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.279] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.279] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.279] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.282] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0227.282] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.282] ReadFile (in: hFile=0x344, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x978, lpOverlapped=0x0) returned 1 [0227.283] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x980, dwBufLen=0x980 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x980) returned 1 [0227.283] WriteFile (in: hFile=0x364, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x980, lpOverlapped=0x0) returned 1 [0227.284] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2df0) returned 1 [0227.284] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.284] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.284] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.284] WriteFile (in: hFile=0x364, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.284] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.284] CloseHandle (hObject=0x344) returned 1 [0227.284] CloseHandle (hObject=0x364) returned 1 [0227.285] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.286] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.286] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.288] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1347) returned 1 [0227.288] CloseHandle (hObject=0x364) returned 1 [0227.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0227.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.288] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.288] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.288] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.288] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.289] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0227.289] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.289] ReadFile (in: hFile=0x364, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x543, lpOverlapped=0x0) returned 1 [0227.291] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550, dwBufLen=0x550 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550) returned 1 [0227.291] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x550, lpOverlapped=0x0) returned 1 [0227.292] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2df0) returned 1 [0227.292] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.292] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.292] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.292] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.292] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.292] CloseHandle (hObject=0x364) returned 1 [0227.292] CloseHandle (hObject=0x344) returned 1 [0227.293] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0227.293] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.293] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.294] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1457) returned 1 [0227.294] CloseHandle (hObject=0x344) returned 1 [0227.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0227.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.294] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.294] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.294] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.294] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.295] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0227.295] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.295] ReadFile (in: hFile=0x344, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5b1, lpOverlapped=0x0) returned 1 [0227.296] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5c0) returned 1 [0227.296] WriteFile (in: hFile=0x364, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5c0, lpOverlapped=0x0) returned 1 [0227.297] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2df0) returned 1 [0227.297] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.297] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.297] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.297] WriteFile (in: hFile=0x364, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.297] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.297] CloseHandle (hObject=0x344) returned 1 [0227.298] CloseHandle (hObject=0x364) returned 1 [0227.298] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0227.299] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.299] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.299] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1458) returned 1 [0227.299] CloseHandle (hObject=0x364) returned 1 [0227.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0227.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.300] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.300] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.300] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.300] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.301] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0227.301] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.301] ReadFile (in: hFile=0x364, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5b2, lpOverlapped=0x0) returned 1 [0227.302] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5c0) returned 1 [0227.302] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5c0, lpOverlapped=0x0) returned 1 [0227.303] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2df0) returned 1 [0227.303] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.303] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.303] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.303] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.303] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.303] CloseHandle (hObject=0x364) returned 1 [0227.303] CloseHandle (hObject=0x344) returned 1 [0227.304] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0227.305] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.305] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.305] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=811) returned 1 [0227.305] CloseHandle (hObject=0x344) returned 1 [0227.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0227.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.305] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.305] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.305] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.305] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.306] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0227.306] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.306] ReadFile (in: hFile=0x344, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x32b, lpOverlapped=0x0) returned 1 [0227.308] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x330, dwBufLen=0x330 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x330) returned 1 [0227.308] WriteFile (in: hFile=0x364, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x330, lpOverlapped=0x0) returned 1 [0227.308] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2df0) returned 1 [0227.309] CryptSetKeyParam (hKey=0x5a2df0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.309] CryptEncrypt (in: hKey=0x5a2df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.309] CryptDestroyKey (hKey=0x5a2df0) returned 1 [0227.309] WriteFile (in: hFile=0x364, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.309] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.309] CloseHandle (hObject=0x344) returned 1 [0227.309] CloseHandle (hObject=0x364) returned 1 [0227.310] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0227.310] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.310] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.311] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=5884) returned 1 [0227.311] CloseHandle (hObject=0x364) returned 1 [0227.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.311] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0227.311] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.311] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.311] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.311] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0227.311] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.311] ReadFile (in: hFile=0x364, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x16fc, lpOverlapped=0x0) returned 1 [0227.425] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x1700, dwBufLen=0x1700 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x1700) returned 1 [0227.425] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x1700, lpOverlapped=0x0) returned 1 [0227.426] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2cb0) returned 1 [0227.426] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.426] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.426] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0227.426] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.426] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.426] CloseHandle (hObject=0x364) returned 1 [0227.427] CloseHandle (hObject=0x344) returned 1 [0227.427] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.429] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.429] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.430] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1383) returned 1 [0227.430] CloseHandle (hObject=0x344) returned 1 [0227.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0227.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.430] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.430] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.430] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.430] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.587] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2db0) returned 1 [0227.587] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.587] ReadFile (in: hFile=0x344, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x567, lpOverlapped=0x0) returned 1 [0227.589] CryptEncrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x570, dwBufLen=0x570 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x570) returned 1 [0227.589] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x570, lpOverlapped=0x0) returned 1 [0227.590] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.590] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.590] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.590] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.590] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.591] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.591] CloseHandle (hObject=0x344) returned 1 [0227.591] CloseHandle (hObject=0x334) returned 1 [0227.591] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0227.593] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.593] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.595] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=6241) returned 1 [0227.595] CloseHandle (hObject=0x334) returned 1 [0227.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.595] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.595] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.596] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.596] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.598] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2db0) returned 1 [0227.598] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.598] ReadFile (in: hFile=0x334, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x1861, lpOverlapped=0x0) returned 1 [0227.600] CryptEncrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x1870, dwBufLen=0x1870 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x1870) returned 1 [0227.600] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x1870, lpOverlapped=0x0) returned 1 [0227.601] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.601] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.601] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.601] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.601] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.601] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.601] CloseHandle (hObject=0x334) returned 1 [0227.602] CloseHandle (hObject=0x344) returned 1 [0227.602] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.604] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.604] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.604] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=9503) returned 1 [0227.604] CloseHandle (hObject=0x344) returned 1 [0227.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0227.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.604] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.604] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.605] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.605] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.606] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2db0) returned 1 [0227.606] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.606] ReadFile (in: hFile=0x344, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x251f, lpOverlapped=0x0) returned 1 [0227.608] CryptEncrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2520, dwBufLen=0x2520 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2520) returned 1 [0227.608] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x2520, lpOverlapped=0x0) returned 1 [0227.609] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2cb0) returned 1 [0227.609] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.609] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.609] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0227.609] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.609] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.609] CloseHandle (hObject=0x344) returned 1 [0227.610] CloseHandle (hObject=0x334) returned 1 [0227.610] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0227.612] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.612] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.613] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1606) returned 1 [0227.613] CloseHandle (hObject=0x334) returned 1 [0227.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0227.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.613] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.613] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.613] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.613] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0227.614] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2db0) returned 1 [0227.614] CryptSetKeyParam (hKey=0x5a2db0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.614] ReadFile (in: hFile=0x334, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x646, lpOverlapped=0x0) returned 1 [0227.616] CryptEncrypt (in: hKey=0x5a2db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x650, dwBufLen=0x650 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x650) returned 1 [0227.616] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x650, lpOverlapped=0x0) returned 1 [0227.617] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.617] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.617] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.617] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.618] WriteFile (in: hFile=0x344, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.618] CryptDestroyKey (hKey=0x5a2db0) returned 1 [0227.618] CloseHandle (hObject=0x334) returned 1 [0227.618] CloseHandle (hObject=0x344) returned 1 [0227.618] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0227.620] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.620] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.730] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1988) returned 1 [0227.730] CloseHandle (hObject=0x334) returned 1 [0227.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.731] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.731] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.731] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.731] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0227.731] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0227.731] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.731] ReadFile (in: hFile=0x334, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x7c4, lpOverlapped=0x0) returned 1 [0227.787] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7d0) returned 1 [0227.787] WriteFile (in: hFile=0x350, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x7d0, lpOverlapped=0x0) returned 1 [0227.789] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.789] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.789] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.789] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.789] WriteFile (in: hFile=0x350, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.789] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0227.789] CloseHandle (hObject=0x334) returned 1 [0227.789] CloseHandle (hObject=0x350) returned 1 [0227.790] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.791] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.791] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0227.792] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1872) returned 1 [0227.792] CloseHandle (hObject=0x350) returned 1 [0227.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.793] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0227.793] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.793] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.793] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.793] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0227.793] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.793] ReadFile (in: hFile=0x350, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x750, lpOverlapped=0x0) returned 1 [0227.795] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x760, dwBufLen=0x760 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x760) returned 1 [0227.795] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x760, lpOverlapped=0x0) returned 1 [0227.796] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.796] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.796] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.796] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.796] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.797] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0227.797] CloseHandle (hObject=0x350) returned 1 [0227.797] CloseHandle (hObject=0x334) returned 1 [0227.797] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.799] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.799] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.801] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=913) returned 1 [0227.801] CloseHandle (hObject=0x334) returned 1 [0227.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0227.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.801] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.801] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.801] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.801] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0227.802] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0227.802] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.802] ReadFile (in: hFile=0x334, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x391, lpOverlapped=0x0) returned 1 [0227.804] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x3a0) returned 1 [0227.804] WriteFile (in: hFile=0x350, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x3a0, lpOverlapped=0x0) returned 1 [0227.806] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.806] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.806] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.806] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.806] WriteFile (in: hFile=0x350, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.806] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0227.806] CloseHandle (hObject=0x334) returned 1 [0227.806] CloseHandle (hObject=0x350) returned 1 [0227.807] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0227.808] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.808] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0227.808] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1452) returned 1 [0227.808] CloseHandle (hObject=0x350) returned 1 [0227.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0227.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.809] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0227.809] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.809] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.809] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.809] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0227.809] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.809] ReadFile (in: hFile=0x350, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5ac, lpOverlapped=0x0) returned 1 [0227.811] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5b0) returned 1 [0227.811] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5b0, lpOverlapped=0x0) returned 1 [0227.813] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2d30) returned 1 [0227.813] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.813] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.813] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0227.813] WriteFile (in: hFile=0x334, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.813] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0227.813] CloseHandle (hObject=0x350) returned 1 [0227.813] CloseHandle (hObject=0x334) returned 1 [0227.814] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0227.815] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0227.815] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.817] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=596341) returned 1 [0227.817] CloseHandle (hObject=0x334) returned 1 [0227.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0227.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0227.817] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0227.817] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.818] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0227.818] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0227.818] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0227.818] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.818] ReadFile (in: hFile=0x334, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x91975, lpOverlapped=0x0) returned 1 [0227.942] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x91980, dwBufLen=0x91980 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x91980) returned 1 [0227.947] WriteFile (in: hFile=0x350, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x91980, lpOverlapped=0x0) returned 1 [0227.958] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2eb0) returned 1 [0227.958] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0227.958] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0227.958] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0227.958] WriteFile (in: hFile=0x350, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0227.958] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0227.958] CloseHandle (hObject=0x334) returned 1 [0227.958] CloseHandle (hObject=0x350) returned 1 [0227.963] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0227.969] SetEvent (hEvent=0x2ec) returned 1 [0228.115] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0228.115] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0228.115] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=9352) returned 1 [0228.116] CloseHandle (hObject=0x37c) returned 1 [0228.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0228.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0228.142] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.142] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.142] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.142] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0228.142] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0228.142] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.142] ReadFile (in: hFile=0x378, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x2488, lpOverlapped=0x0) returned 1 [0228.144] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2490, dwBufLen=0x2490 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2490) returned 1 [0228.144] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x2490, lpOverlapped=0x0) returned 1 [0228.145] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2eb0) returned 1 [0228.145] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.145] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0228.145] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0228.145] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0228.145] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0228.146] CloseHandle (hObject=0x378) returned 1 [0228.146] CloseHandle (hObject=0x37c) returned 1 [0228.146] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0228.147] SetEvent (hEvent=0x2ec) returned 1 [0228.147] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0228.147] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0228.148] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=819) returned 1 [0228.148] CloseHandle (hObject=0x37c) returned 1 [0228.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0228.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0228.148] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0228.148] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.148] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.148] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.148] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0228.148] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.148] ReadFile (in: hFile=0x37c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x333, lpOverlapped=0x0) returned 1 [0228.150] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x340, dwBufLen=0x340 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x340) returned 1 [0228.150] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x340, lpOverlapped=0x0) returned 1 [0228.151] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2eb0) returned 1 [0228.151] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.151] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50, dwBufLen=0x50 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50) returned 1 [0228.151] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0228.151] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x102, lpOverlapped=0x0) returned 1 [0228.151] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0228.151] CloseHandle (hObject=0x37c) returned 1 [0228.151] CloseHandle (hObject=0x378) returned 1 [0228.152] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0228.152] SetEvent (hEvent=0x2ec) returned 1 [0228.153] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0228.153] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.153] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2624) returned 1 [0228.153] CloseHandle (hObject=0x378) returned 1 [0228.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0228.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0228.153] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.153] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.153] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.153] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0228.154] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0228.154] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.154] ReadFile (in: hFile=0x378, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0xa40, lpOverlapped=0x0) returned 1 [0228.157] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xa50, dwBufLen=0xa50 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xa50) returned 1 [0228.157] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xa50, lpOverlapped=0x0) returned 1 [0228.157] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0228.157] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.157] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0228.157] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0228.158] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0228.158] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0228.158] CloseHandle (hObject=0x378) returned 1 [0228.158] CloseHandle (hObject=0x37c) returned 1 [0228.158] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0228.159] SetEvent (hEvent=0x2ec) returned 1 [0228.159] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0228.159] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0228.161] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=4274) returned 1 [0228.161] CloseHandle (hObject=0x37c) returned 1 [0228.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0228.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0228.161] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0228.161] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.161] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.161] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.161] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0228.161] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.162] ReadFile (in: hFile=0x37c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x10b2, lpOverlapped=0x0) returned 1 [0228.163] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x10c0) returned 1 [0228.163] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x10c0, lpOverlapped=0x0) returned 1 [0228.164] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0228.164] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.164] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0228.164] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0228.164] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0228.164] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0228.164] CloseHandle (hObject=0x37c) returned 1 [0228.164] CloseHandle (hObject=0x378) returned 1 [0228.165] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0228.166] SetEvent (hEvent=0x2ec) returned 1 [0228.166] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0228.166] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.174] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=16852) returned 1 [0228.174] CloseHandle (hObject=0x378) returned 1 [0228.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0228.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0228.175] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0228.175] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.175] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0228.175] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0228.175] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0228.175] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0228.175] ReadFile (in: hFile=0x378, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x41d4, lpOverlapped=0x0) returned 1 [0229.637] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x41e0) returned 1 [0229.641] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x41e0, lpOverlapped=0x0) returned 1 [0229.669] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0229.669] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.669] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0229.669] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.669] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0229.669] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0229.669] CloseHandle (hObject=0x378) returned 1 [0229.670] CloseHandle (hObject=0x37c) returned 1 [0229.670] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0229.671] SetEvent (hEvent=0x2ec) returned 1 [0229.672] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0229.672] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.672] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=20577) returned 1 [0229.672] CloseHandle (hObject=0x37c) returned 1 [0229.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0229.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.672] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.672] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.672] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.673] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.673] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0229.673] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.673] ReadFile (in: hFile=0x37c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5061, lpOverlapped=0x0) returned 1 [0229.675] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5070, dwBufLen=0x5070 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5070) returned 1 [0229.675] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5070, lpOverlapped=0x0) returned 1 [0229.677] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0229.677] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.677] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0229.677] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.677] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0229.677] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0229.677] CloseHandle (hObject=0x37c) returned 1 [0229.677] CloseHandle (hObject=0x378) returned 1 [0229.678] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0229.680] SetEvent (hEvent=0x2ec) returned 1 [0229.680] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0229.680] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.681] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=8723) returned 1 [0229.681] CloseHandle (hObject=0x378) returned 1 [0229.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0229.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.681] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.681] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.681] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.681] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.682] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0229.682] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.682] ReadFile (in: hFile=0x378, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x2213, lpOverlapped=0x0) returned 1 [0229.684] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2220, dwBufLen=0x2220 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2220) returned 1 [0229.684] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x2220, lpOverlapped=0x0) returned 1 [0229.685] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0229.685] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.685] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0229.686] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.686] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0229.686] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0229.686] CloseHandle (hObject=0x378) returned 1 [0229.686] CloseHandle (hObject=0x37c) returned 1 [0229.687] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0229.688] SetEvent (hEvent=0x2ec) returned 1 [0229.688] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0229.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.689] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=15067) returned 1 [0229.689] CloseHandle (hObject=0x37c) returned 1 [0229.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0229.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.689] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.689] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.690] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0229.690] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.690] ReadFile (in: hFile=0x37c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x3adb, lpOverlapped=0x0) returned 1 [0229.691] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x3ae0, dwBufLen=0x3ae0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x3ae0) returned 1 [0229.691] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x3ae0, lpOverlapped=0x0) returned 1 [0229.692] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0229.692] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.692] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x30, dwBufLen=0x30 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x30) returned 1 [0229.692] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.692] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xe2, lpOverlapped=0x0) returned 1 [0229.693] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0229.693] CloseHandle (hObject=0x37c) returned 1 [0229.693] CloseHandle (hObject=0x378) returned 1 [0229.693] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0229.694] SetEvent (hEvent=0x2ec) returned 1 [0229.695] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0229.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.695] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1069) returned 1 [0229.695] CloseHandle (hObject=0x378) returned 1 [0229.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0229.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.695] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.695] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.695] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0229.696] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.696] ReadFile (in: hFile=0x378, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x42d, lpOverlapped=0x0) returned 1 [0229.698] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x430, dwBufLen=0x430 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x430) returned 1 [0229.698] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x430, lpOverlapped=0x0) returned 1 [0229.700] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0229.700] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.700] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x30, dwBufLen=0x30 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x30) returned 1 [0229.700] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.700] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xe2, lpOverlapped=0x0) returned 1 [0229.700] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0229.700] CloseHandle (hObject=0x378) returned 1 [0229.700] CloseHandle (hObject=0x37c) returned 1 [0229.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0229.702] SetEvent (hEvent=0x2ec) returned 1 [0229.702] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0229.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.703] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1061) returned 1 [0229.703] CloseHandle (hObject=0x37c) returned 1 [0229.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0229.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.703] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.703] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.703] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0229.703] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.703] ReadFile (in: hFile=0x37c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x425, lpOverlapped=0x0) returned 1 [0229.705] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x430, dwBufLen=0x430 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x430) returned 1 [0229.705] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x430, lpOverlapped=0x0) returned 1 [0229.706] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0229.706] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.706] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x30, dwBufLen=0x30 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x30) returned 1 [0229.706] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0229.706] WriteFile (in: hFile=0x378, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xe2, lpOverlapped=0x0) returned 1 [0229.706] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0229.706] CloseHandle (hObject=0x37c) returned 1 [0229.706] CloseHandle (hObject=0x378) returned 1 [0229.707] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0229.707] SetEvent (hEvent=0x2ec) returned 1 [0229.708] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0229.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.708] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1682) returned 1 [0229.708] CloseHandle (hObject=0x378) returned 1 [0229.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0229.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0229.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0229.708] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.708] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0229.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0229.708] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2d30) returned 1 [0229.708] CryptSetKeyParam (hKey=0x5a2d30, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0229.708] ReadFile (in: hFile=0x378, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x692, lpOverlapped=0x0) returned 1 [0230.454] CryptEncrypt (in: hKey=0x5a2d30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x6a0) returned 1 [0230.454] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x6a0, lpOverlapped=0x0) returned 1 [0230.455] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2e70) returned 1 [0230.455] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0230.455] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x30, dwBufLen=0x30 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x30) returned 1 [0230.455] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0230.455] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xe2, lpOverlapped=0x0) returned 1 [0230.456] CryptDestroyKey (hKey=0x5a2d30) returned 1 [0230.456] CloseHandle (hObject=0x378) returned 1 [0230.456] CloseHandle (hObject=0x37c) returned 1 [0230.457] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0230.457] SetEvent (hEvent=0x2ec) returned 1 [0230.458] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.696] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=27045) returned 1 [0230.697] CloseHandle (hObject=0x388) returned 1 [0230.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0230.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.714] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.717] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=15097) returned 1 [0230.717] CloseHandle (hObject=0x388) returned 1 [0230.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0230.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.717] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.717] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=38485) returned 1 [0230.717] CloseHandle (hObject=0x388) returned 1 [0230.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0230.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.718] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.718] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1218) returned 1 [0230.718] CloseHandle (hObject=0x388) returned 1 [0230.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0230.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.719] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.719] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=209) returned 1 [0230.719] CloseHandle (hObject=0x388) returned 1 [0230.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0230.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.720] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.721] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=471) returned 1 [0230.721] CloseHandle (hObject=0x388) returned 1 [0230.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0230.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.721] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.721] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=215) returned 1 [0230.721] CloseHandle (hObject=0x388) returned 1 [0230.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0230.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.722] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.722] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1437) returned 1 [0230.722] CloseHandle (hObject=0x388) returned 1 [0230.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0230.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.722] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.723] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=219) returned 1 [0230.723] CloseHandle (hObject=0x388) returned 1 [0230.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0230.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.724] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.725] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=924) returned 1 [0230.725] CloseHandle (hObject=0x388) returned 1 [0230.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0230.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.725] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.726] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=215) returned 1 [0230.726] CloseHandle (hObject=0x388) returned 1 [0230.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0230.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.727] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.727] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=749) returned 1 [0230.727] CloseHandle (hObject=0x388) returned 1 [0230.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0230.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.727] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.728] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=749) returned 1 [0230.728] CloseHandle (hObject=0x388) returned 1 [0230.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0230.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.729] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.729] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2764) returned 1 [0230.729] CloseHandle (hObject=0x388) returned 1 [0230.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0230.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.730] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.730] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=591) returned 1 [0230.730] CloseHandle (hObject=0x388) returned 1 [0230.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0230.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.731] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.732] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1166) returned 1 [0230.732] CloseHandle (hObject=0x388) returned 1 [0230.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0230.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.732] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.732] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=207) returned 1 [0230.732] CloseHandle (hObject=0x388) returned 1 [0230.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0230.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.733] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.733] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=46624) returned 1 [0230.733] CloseHandle (hObject=0x388) returned 1 [0230.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0230.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.734] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.734] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=747280) returned 1 [0230.734] CloseHandle (hObject=0x388) returned 1 [0230.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0230.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.735] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.735] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=815680) returned 1 [0230.735] CloseHandle (hObject=0x388) returned 1 [0230.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0230.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.736] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.736] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1100368) returned 1 [0230.736] CloseHandle (hObject=0x388) returned 1 [0230.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0230.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.736] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.737] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=3053984) returned 1 [0230.737] CloseHandle (hObject=0x388) returned 1 [0230.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0230.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0230.738] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0 [0230.738] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.738] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2227968) returned 1 [0230.738] CloseHandle (hObject=0x388) returned 1 [0230.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0230.738] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0230.738] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0 [0230.738] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.739] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=3195696) returned 1 [0230.739] CloseHandle (hObject=0x388) returned 1 [0230.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0230.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0230.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0230.739] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.740] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=4120784) returned 1 [0230.740] CloseHandle (hObject=0x388) returned 1 [0230.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0230.740] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0 [0230.740] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0230.740] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.740] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2592) returned 1 [0230.740] CloseHandle (hObject=0x388) returned 1 [0230.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0230.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.741] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.741] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2462) returned 1 [0230.741] CloseHandle (hObject=0x388) returned 1 [0230.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0230.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.742] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.742] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2436) returned 1 [0230.742] CloseHandle (hObject=0x388) returned 1 [0230.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0230.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.744] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.744] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2556) returned 1 [0230.744] CloseHandle (hObject=0x388) returned 1 [0230.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0230.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.745] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.745] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2514) returned 1 [0230.745] CloseHandle (hObject=0x388) returned 1 [0230.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0230.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.746] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.746] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2616) returned 1 [0230.746] CloseHandle (hObject=0x388) returned 1 [0230.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0230.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.746] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.747] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2578) returned 1 [0230.747] CloseHandle (hObject=0x388) returned 1 [0230.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0230.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.748] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.748] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=3024) returned 1 [0230.748] CloseHandle (hObject=0x388) returned 1 [0230.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0230.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.748] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.749] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2658) returned 1 [0230.749] CloseHandle (hObject=0x388) returned 1 [0230.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0230.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.749] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.751] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2628) returned 1 [0230.751] CloseHandle (hObject=0x388) returned 1 [0230.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0230.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.751] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.752] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2652) returned 1 [0230.752] CloseHandle (hObject=0x388) returned 1 [0230.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0230.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.752] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.752] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2526) returned 1 [0230.752] CloseHandle (hObject=0x388) returned 1 [0230.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0230.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.753] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0230.753] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2522) returned 1 [0230.753] CloseHandle (hObject=0x388) returned 1 [0230.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0230.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0230.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.754] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0230.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.182] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2568) returned 1 [0231.182] CloseHandle (hObject=0x388) returned 1 [0231.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0231.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.182] SetEvent (hEvent=0x2ec) returned 1 [0231.182] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.182] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2580) returned 1 [0231.182] CloseHandle (hObject=0x388) returned 1 [0231.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0231.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.183] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.191] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2600) returned 1 [0231.191] CloseHandle (hObject=0x388) returned 1 [0231.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0231.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.191] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.192] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2246) returned 1 [0231.192] CloseHandle (hObject=0x388) returned 1 [0231.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0231.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.192] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.192] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2240) returned 1 [0231.193] CloseHandle (hObject=0x388) returned 1 [0231.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0231.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.193] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.193] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2644) returned 1 [0231.193] CloseHandle (hObject=0x388) returned 1 [0231.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0231.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.194] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0231.322] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2542) returned 1 [0231.322] CloseHandle (hObject=0x38c) returned 1 [0231.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0231.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.323] SetEvent (hEvent=0x2ec) returned 1 [0231.323] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0231.509] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1941) returned 1 [0231.509] CloseHandle (hObject=0x374) returned 1 [0231.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0231.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0231.510] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0231.510] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0231.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.510] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0231.510] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0231.510] ReadFile (in: hFile=0x374, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x795, lpOverlapped=0x0) returned 1 [0231.563] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7a0) returned 1 [0231.563] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x7a0, lpOverlapped=0x0) returned 1 [0231.564] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0231.564] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0231.564] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0231.564] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.564] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0231.564] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.564] CloseHandle (hObject=0x374) returned 1 [0231.564] CloseHandle (hObject=0x398) returned 1 [0231.565] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0231.566] SetEvent (hEvent=0x2ec) returned 1 [0231.566] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.567] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1349) returned 1 [0231.567] CloseHandle (hObject=0x398) returned 1 [0231.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0231.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.567] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0231.567] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0231.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0231.568] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0231.568] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0231.568] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x545, lpOverlapped=0x0) returned 1 [0231.570] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550, dwBufLen=0x550 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550) returned 1 [0231.570] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x550, lpOverlapped=0x0) returned 1 [0231.570] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0231.570] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0231.570] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0231.570] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.571] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0231.571] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.571] CloseHandle (hObject=0x398) returned 1 [0231.571] CloseHandle (hObject=0x374) returned 1 [0231.572] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0231.572] SetEvent (hEvent=0x2ec) returned 1 [0231.573] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0231.576] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=819) returned 1 [0231.576] CloseHandle (hObject=0x374) returned 1 [0231.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0231.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0231.576] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0231.576] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0231.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.576] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0231.576] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0231.576] ReadFile (in: hFile=0x374, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x333, lpOverlapped=0x0) returned 1 [0231.579] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x340, dwBufLen=0x340 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x340) returned 1 [0231.579] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x340, lpOverlapped=0x0) returned 1 [0231.581] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0231.581] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0231.581] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50, dwBufLen=0x50 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50) returned 1 [0231.581] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.581] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x102, lpOverlapped=0x0) returned 1 [0231.581] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.581] CloseHandle (hObject=0x374) returned 1 [0231.581] CloseHandle (hObject=0x398) returned 1 [0231.582] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0231.583] SetEvent (hEvent=0x2ec) returned 1 [0231.583] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.795] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2624) returned 1 [0231.801] CloseHandle (hObject=0x388) returned 1 [0231.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0231.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0231.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.816] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0231.816] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0231.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.868] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0231.868] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0231.868] ReadFile (in: hFile=0x388, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0xa40, lpOverlapped=0x0) returned 1 [0231.916] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xa50, dwBufLen=0xa50 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xa50) returned 1 [0231.916] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xa50, lpOverlapped=0x0) returned 1 [0231.917] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0231.917] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0231.917] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0231.917] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0231.917] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0231.917] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0231.917] CloseHandle (hObject=0x388) returned 1 [0231.917] CloseHandle (hObject=0x398) returned 1 [0231.918] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0231.919] SetEvent (hEvent=0x2ec) returned 1 [0231.919] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0231.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.085] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=596341) returned 1 [0233.085] CloseHandle (hObject=0x398) returned 1 [0233.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0233.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.085] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.086] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.086] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0233.086] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.086] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x91975, lpOverlapped=0x0) returned 1 [0233.094] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x91980, dwBufLen=0x91980 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x91980) returned 1 [0233.099] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x91980, lpOverlapped=0x0) returned 1 [0233.109] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0233.109] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.109] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0233.109] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.109] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0233.109] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.109] CloseHandle (hObject=0x398) returned 1 [0233.109] CloseHandle (hObject=0x388) returned 1 [0233.115] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0233.120] SetEvent (hEvent=0x2ec) returned 1 [0233.121] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0233.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.609] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=5557) returned 1 [0233.609] CloseHandle (hObject=0x388) returned 1 [0233.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0233.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.618] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.618] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.633] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0233.633] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.633] ReadFile (in: hFile=0x388, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x15b5, lpOverlapped=0x0) returned 1 [0233.642] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x15c0) returned 1 [0233.643] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x15c0, lpOverlapped=0x0) returned 1 [0233.643] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0233.643] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.643] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0233.644] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.644] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0233.644] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.644] CloseHandle (hObject=0x388) returned 1 [0233.644] CloseHandle (hObject=0x39c) returned 1 [0233.645] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0233.645] SetEvent (hEvent=0x2ec) returned 1 [0233.646] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0233.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.647] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1383) returned 1 [0233.647] CloseHandle (hObject=0x39c) returned 1 [0233.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0233.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.647] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.647] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.649] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0233.649] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.649] ReadFile (in: hFile=0x39c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x567, lpOverlapped=0x0) returned 1 [0233.650] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x570, dwBufLen=0x570 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x570) returned 1 [0233.650] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x570, lpOverlapped=0x0) returned 1 [0233.651] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0233.651] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.651] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0233.651] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.651] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0233.651] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.651] CloseHandle (hObject=0x39c) returned 1 [0233.651] CloseHandle (hObject=0x388) returned 1 [0233.652] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0233.653] SetEvent (hEvent=0x2ec) returned 1 [0233.653] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0233.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.653] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2362) returned 1 [0233.653] CloseHandle (hObject=0x388) returned 1 [0233.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0233.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.654] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.654] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.654] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0233.654] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.654] ReadFile (in: hFile=0x388, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x93a, lpOverlapped=0x0) returned 1 [0233.655] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x940, dwBufLen=0x940 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x940) returned 1 [0233.655] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x940, lpOverlapped=0x0) returned 1 [0233.656] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0233.656] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.656] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0233.656] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.656] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0233.656] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.656] CloseHandle (hObject=0x388) returned 1 [0233.657] CloseHandle (hObject=0x39c) returned 1 [0233.659] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0233.660] SetEvent (hEvent=0x2ec) returned 1 [0233.660] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0233.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.662] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=4274) returned 1 [0233.662] CloseHandle (hObject=0x39c) returned 1 [0233.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0233.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.662] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.662] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.663] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0233.663] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.663] ReadFile (in: hFile=0x39c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x10b2, lpOverlapped=0x0) returned 1 [0233.664] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x10c0) returned 1 [0233.664] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x10c0, lpOverlapped=0x0) returned 1 [0233.665] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0233.665] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.665] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0233.665] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.665] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0233.665] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.665] CloseHandle (hObject=0x39c) returned 1 [0233.665] CloseHandle (hObject=0x388) returned 1 [0233.667] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0233.668] SetEvent (hEvent=0x2ec) returned 1 [0233.668] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0233.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.668] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1606) returned 1 [0233.668] CloseHandle (hObject=0x388) returned 1 [0233.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0233.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.668] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.668] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.670] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0233.670] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.670] ReadFile (in: hFile=0x388, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x646, lpOverlapped=0x0) returned 1 [0233.672] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x650, dwBufLen=0x650 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x650) returned 1 [0233.672] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x650, lpOverlapped=0x0) returned 1 [0233.672] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0233.672] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.673] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0233.673] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.673] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0233.673] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.673] CloseHandle (hObject=0x388) returned 1 [0233.673] CloseHandle (hObject=0x39c) returned 1 [0233.675] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0233.676] SetEvent (hEvent=0x2ec) returned 1 [0233.676] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0233.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.886] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1988) returned 1 [0233.886] CloseHandle (hObject=0x374) returned 1 [0233.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0233.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.886] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.886] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0233.887] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0233.887] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.887] ReadFile (in: hFile=0x374, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x7c4, lpOverlapped=0x0) returned 1 [0233.892] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7d0) returned 1 [0233.892] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x7d0, lpOverlapped=0x0) returned 1 [0233.893] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0233.893] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.893] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0233.893] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.893] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0233.893] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0233.893] CloseHandle (hObject=0x374) returned 1 [0233.893] CloseHandle (hObject=0x370) returned 1 [0233.895] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0233.896] SetEvent (hEvent=0x2ec) returned 1 [0233.896] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0233.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.988] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=4207) returned 1 [0233.990] CloseHandle (hObject=0x39c) returned 1 [0233.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0233.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.991] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.991] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.991] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0233.991] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.991] ReadFile (in: hFile=0x39c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x106f, lpOverlapped=0x0) returned 1 [0233.993] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x1070, dwBufLen=0x1070 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x1070) returned 1 [0233.993] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x1070, lpOverlapped=0x0) returned 1 [0233.994] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0233.994] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.994] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0233.994] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0233.994] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0233.994] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0233.994] CloseHandle (hObject=0x39c) returned 1 [0233.994] CloseHandle (hObject=0x374) returned 1 [0233.995] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0233.996] SetEvent (hEvent=0x2ec) returned 1 [0233.996] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0233.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.997] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=16683) returned 1 [0233.997] CloseHandle (hObject=0x374) returned 1 [0233.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0233.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0233.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0233.997] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.997] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0233.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0233.999] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0233.999] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0233.999] ReadFile (in: hFile=0x374, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x412b, lpOverlapped=0x0) returned 1 [0234.000] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x4130, dwBufLen=0x4130 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x4130) returned 1 [0234.001] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x4130, lpOverlapped=0x0) returned 1 [0234.002] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0234.002] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.002] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.002] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0234.002] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.002] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0234.002] CloseHandle (hObject=0x374) returned 1 [0234.002] CloseHandle (hObject=0x39c) returned 1 [0234.003] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0234.004] SetEvent (hEvent=0x2ec) returned 1 [0234.004] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0234.004] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1452) returned 1 [0234.004] CloseHandle (hObject=0x39c) returned 1 [0234.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0234.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0234.005] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.005] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0234.007] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0234.007] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.007] ReadFile (in: hFile=0x39c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5ac, lpOverlapped=0x0) returned 1 [0234.008] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5b0) returned 1 [0234.008] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5b0, lpOverlapped=0x0) returned 1 [0234.009] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0234.009] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.009] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.009] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0234.009] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.010] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0234.010] CloseHandle (hObject=0x39c) returned 1 [0234.010] CloseHandle (hObject=0x374) returned 1 [0234.011] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0234.012] SetEvent (hEvent=0x2ec) returned 1 [0234.012] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0234.013] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1872) returned 1 [0234.013] CloseHandle (hObject=0x374) returned 1 [0234.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0234.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0234.013] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.013] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0234.014] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2e70) returned 1 [0234.014] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.014] ReadFile (in: hFile=0x374, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x750, lpOverlapped=0x0) returned 1 [0234.015] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x760, dwBufLen=0x760 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x760) returned 1 [0234.015] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x760, lpOverlapped=0x0) returned 1 [0234.016] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2fb0) returned 1 [0234.016] CryptSetKeyParam (hKey=0x5a2fb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.016] CryptEncrypt (in: hKey=0x5a2fb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.016] CryptDestroyKey (hKey=0x5a2fb0) returned 1 [0234.016] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.016] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0234.016] CloseHandle (hObject=0x374) returned 1 [0234.016] CloseHandle (hObject=0x39c) returned 1 [0234.019] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0234.020] SetEvent (hEvent=0x2ec) returned 1 [0234.020] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.109] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1347) returned 1 [0234.109] CloseHandle (hObject=0x370) returned 1 [0234.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0234.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.110] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.110] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.110] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0234.110] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.110] ReadFile (in: hFile=0x370, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x543, lpOverlapped=0x0) returned 1 [0234.111] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550, dwBufLen=0x550 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550) returned 1 [0234.111] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x550, lpOverlapped=0x0) returned 1 [0234.112] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0234.112] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.112] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.112] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.112] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.113] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.113] CloseHandle (hObject=0x370) returned 1 [0234.113] CloseHandle (hObject=0x398) returned 1 [0234.113] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0234.114] SetEvent (hEvent=0x2ec) returned 1 [0234.114] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.115] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1458) returned 1 [0234.115] CloseHandle (hObject=0x398) returned 1 [0234.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0234.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.115] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.115] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.115] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0234.115] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.116] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5b2, lpOverlapped=0x0) returned 1 [0234.117] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5c0) returned 1 [0234.117] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5c0, lpOverlapped=0x0) returned 1 [0234.118] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0234.118] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.118] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.118] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.118] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.118] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.118] CloseHandle (hObject=0x398) returned 1 [0234.118] CloseHandle (hObject=0x370) returned 1 [0234.119] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0234.120] SetEvent (hEvent=0x2ec) returned 1 [0234.120] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.122] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=811) returned 1 [0234.122] CloseHandle (hObject=0x38c) returned 1 [0234.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0234.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.123] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.123] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.125] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0234.125] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.125] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x32b, lpOverlapped=0x0) returned 1 [0234.128] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x330, dwBufLen=0x330 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x330) returned 1 [0234.128] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x330, lpOverlapped=0x0) returned 1 [0234.129] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0234.129] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.129] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.129] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.129] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.129] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.129] CloseHandle (hObject=0x38c) returned 1 [0234.129] CloseHandle (hObject=0x370) returned 1 [0234.130] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0234.131] SetEvent (hEvent=0x2ec) returned 1 [0234.131] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.131] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=5884) returned 1 [0234.131] CloseHandle (hObject=0x370) returned 1 [0234.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0234.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.132] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.132] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.132] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0234.132] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.132] ReadFile (in: hFile=0x370, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x16fc, lpOverlapped=0x0) returned 1 [0234.133] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x1700, dwBufLen=0x1700 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x1700) returned 1 [0234.134] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x1700, lpOverlapped=0x0) returned 1 [0234.134] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0234.134] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.134] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.135] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.135] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.135] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.135] CloseHandle (hObject=0x370) returned 1 [0234.135] CloseHandle (hObject=0x38c) returned 1 [0234.135] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0234.136] SetEvent (hEvent=0x2ec) returned 1 [0234.136] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.137] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=16852) returned 1 [0234.137] CloseHandle (hObject=0x38c) returned 1 [0234.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0234.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.137] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.138] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.138] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0234.138] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.138] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x41d4, lpOverlapped=0x0) returned 1 [0234.139] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x41e0) returned 1 [0234.140] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x41e0, lpOverlapped=0x0) returned 1 [0234.141] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0234.141] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.141] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.141] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.141] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.141] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.141] CloseHandle (hObject=0x38c) returned 1 [0234.141] CloseHandle (hObject=0x370) returned 1 [0234.142] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0234.143] SetEvent (hEvent=0x2ec) returned 1 [0234.143] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.143] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=31094) returned 1 [0234.143] CloseHandle (hObject=0x370) returned 1 [0234.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0234.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.143] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.144] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.145] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0234.145] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.145] ReadFile (in: hFile=0x370, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x7976, lpOverlapped=0x0) returned 1 [0234.147] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7980, dwBufLen=0x7980 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7980) returned 1 [0234.147] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x7980, lpOverlapped=0x0) returned 1 [0234.148] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0234.148] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.148] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.148] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.148] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.148] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.148] CloseHandle (hObject=0x370) returned 1 [0234.148] CloseHandle (hObject=0x38c) returned 1 [0234.149] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0234.150] SetEvent (hEvent=0x2ec) returned 1 [0234.150] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.151] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1450) returned 1 [0234.151] CloseHandle (hObject=0x38c) returned 1 [0234.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0234.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.151] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.151] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.271] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0234.271] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.272] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5aa, lpOverlapped=0x0) returned 1 [0234.273] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5b0) returned 1 [0234.273] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5b0, lpOverlapped=0x0) returned 1 [0234.274] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0234.274] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.274] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50, dwBufLen=0x50 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50) returned 1 [0234.274] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.274] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x102, lpOverlapped=0x0) returned 1 [0234.274] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.274] CloseHandle (hObject=0x38c) returned 1 [0234.274] CloseHandle (hObject=0x370) returned 1 [0234.275] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0234.276] SetEvent (hEvent=0x2ec) returned 1 [0234.276] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.277] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=20577) returned 1 [0234.277] CloseHandle (hObject=0x370) returned 1 [0234.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0234.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.278] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.278] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.278] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0234.278] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.278] ReadFile (in: hFile=0x370, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5061, lpOverlapped=0x0) returned 1 [0234.283] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5070, dwBufLen=0x5070 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5070) returned 1 [0234.283] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5070, lpOverlapped=0x0) returned 1 [0234.284] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0234.284] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.284] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.284] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.284] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.285] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0234.285] CloseHandle (hObject=0x370) returned 1 [0234.285] CloseHandle (hObject=0x38c) returned 1 [0234.285] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0234.287] SetEvent (hEvent=0x2ec) returned 1 [0234.287] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.288] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=8723) returned 1 [0234.288] CloseHandle (hObject=0x38c) returned 1 [0234.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0234.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.288] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.288] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.290] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0234.290] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.290] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x2213, lpOverlapped=0x0) returned 1 [0234.291] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2220, dwBufLen=0x2220 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2220) returned 1 [0234.291] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x2220, lpOverlapped=0x0) returned 1 [0234.292] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0234.292] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.292] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.292] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.292] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.292] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.292] CloseHandle (hObject=0x38c) returned 1 [0234.293] CloseHandle (hObject=0x370) returned 1 [0234.293] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0234.294] SetEvent (hEvent=0x2ec) returned 1 [0234.294] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.295] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2424) returned 1 [0234.295] CloseHandle (hObject=0x370) returned 1 [0234.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0234.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.295] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.295] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.296] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0234.296] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.296] ReadFile (in: hFile=0x370, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x978, lpOverlapped=0x0) returned 1 [0234.297] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x980, dwBufLen=0x980 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x980) returned 1 [0234.297] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x980, lpOverlapped=0x0) returned 1 [0234.298] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0234.298] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.298] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.298] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.298] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.299] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.299] CloseHandle (hObject=0x370) returned 1 [0234.299] CloseHandle (hObject=0x38c) returned 1 [0234.299] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0234.300] SetEvent (hEvent=0x2ec) returned 1 [0234.300] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.301] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1800) returned 1 [0234.301] CloseHandle (hObject=0x38c) returned 1 [0234.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0234.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.301] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.301] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.303] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0234.303] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.303] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x708, lpOverlapped=0x0) returned 1 [0234.304] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x710, dwBufLen=0x710 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x710) returned 1 [0234.304] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x710, lpOverlapped=0x0) returned 1 [0234.305] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0234.305] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.305] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.305] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.305] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.305] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.305] CloseHandle (hObject=0x38c) returned 1 [0234.305] CloseHandle (hObject=0x370) returned 1 [0234.306] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0234.307] SetEvent (hEvent=0x2ec) returned 1 [0234.307] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.308] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=11463) returned 1 [0234.308] CloseHandle (hObject=0x370) returned 1 [0234.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0234.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0234.308] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.308] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.310] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0234.310] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.310] ReadFile (in: hFile=0x370, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x2cc7, lpOverlapped=0x0) returned 1 [0234.415] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2cd0, dwBufLen=0x2cd0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x2cd0) returned 1 [0234.415] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x2cd0, lpOverlapped=0x0) returned 1 [0234.416] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0234.416] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.416] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.417] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.417] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.417] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0234.417] CloseHandle (hObject=0x370) returned 1 [0234.417] CloseHandle (hObject=0x38c) returned 1 [0234.418] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0234.419] SetEvent (hEvent=0x2ec) returned 1 [0234.419] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.658] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1844) returned 1 [0234.658] CloseHandle (hObject=0x38c) returned 1 [0234.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0234.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.666] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.666] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0234.667] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2f70) returned 1 [0234.667] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.667] ReadFile (in: hFile=0x340, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x734, lpOverlapped=0x0) returned 1 [0234.668] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x740, dwBufLen=0x740 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x740) returned 1 [0234.668] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x740, lpOverlapped=0x0) returned 1 [0234.669] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2e70) returned 1 [0234.669] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.669] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0234.669] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0234.669] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0234.670] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0234.670] CloseHandle (hObject=0x340) returned 1 [0234.670] CloseHandle (hObject=0x39c) returned 1 [0234.670] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0234.671] SetEvent (hEvent=0x2ec) returned 1 [0234.671] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0234.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0234.672] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1183416) returned 1 [0234.672] CloseHandle (hObject=0x39c) returned 1 [0234.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0234.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0234.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0234.673] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.673] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0234.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0234.673] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2f70) returned 1 [0234.673] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0234.673] ReadFile (in: hFile=0x39c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x110100, lpOverlapped=0x0) returned 1 [0234.766] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x110100, dwBufLen=0x110100 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x110100) returned 1 [0234.776] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x110100, lpOverlapped=0x0) returned 1 [0236.171] ReadFile (in: hFile=0x39c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x10db8, lpOverlapped=0x0) returned 1 [0236.171] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x10dc0, dwBufLen=0x10dc0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x10dc0) returned 1 [0236.171] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x10dc0, lpOverlapped=0x0) returned 1 [0236.172] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2e70) returned 1 [0236.172] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0236.172] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0236.172] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0236.172] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0236.173] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0236.173] CloseHandle (hObject=0x39c) returned 1 [0236.173] CloseHandle (hObject=0x340) returned 1 [0236.187] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0236.189] SetEvent (hEvent=0x2ec) returned 1 [0236.189] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.662] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=255) returned 1 [0236.662] CloseHandle (hObject=0x370) returned 1 [0236.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0236.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.662] SetEvent (hEvent=0x2ec) returned 1 [0236.662] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.663] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=233) returned 1 [0236.663] CloseHandle (hObject=0x370) returned 1 [0236.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0236.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.663] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.664] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1920) returned 1 [0236.664] CloseHandle (hObject=0x370) returned 1 [0236.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0236.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.664] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.665] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=15776) returned 1 [0236.665] CloseHandle (hObject=0x370) returned 1 [0236.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0236.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.665] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.665] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=37316) returned 1 [0236.665] CloseHandle (hObject=0x370) returned 1 [0236.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0236.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.666] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.666] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=237) returned 1 [0236.666] CloseHandle (hObject=0x370) returned 1 [0236.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0236.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.666] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.667] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=4734) returned 1 [0236.667] CloseHandle (hObject=0x370) returned 1 [0236.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0236.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.668] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.668] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=81292) returned 1 [0236.668] CloseHandle (hObject=0x370) returned 1 [0236.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0236.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.669] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.669] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1990) returned 1 [0236.669] CloseHandle (hObject=0x370) returned 1 [0236.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0236.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.669] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.670] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=232) returned 1 [0236.670] CloseHandle (hObject=0x370) returned 1 [0236.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0236.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.671] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.672] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=10569) returned 1 [0236.672] CloseHandle (hObject=0x370) returned 1 [0236.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0236.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.672] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.672] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=230) returned 1 [0236.673] CloseHandle (hObject=0x370) returned 1 [0236.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0236.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.673] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.674] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=7505) returned 1 [0236.674] CloseHandle (hObject=0x370) returned 1 [0236.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0236.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.674] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.674] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1864) returned 1 [0236.674] CloseHandle (hObject=0x370) returned 1 [0236.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0236.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.675] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.676] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=3650) returned 1 [0236.676] CloseHandle (hObject=0x370) returned 1 [0236.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0236.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.676] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.676] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=4638) returned 1 [0236.676] CloseHandle (hObject=0x370) returned 1 [0236.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0236.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.677] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.677] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=26720) returned 1 [0236.677] CloseHandle (hObject=0x370) returned 1 [0236.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0236.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.678] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.679] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=3168) returned 1 [0236.679] CloseHandle (hObject=0x370) returned 1 [0236.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0236.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.680] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.680] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=15063) returned 1 [0236.680] CloseHandle (hObject=0x370) returned 1 [0236.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0236.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.681] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.682] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1569) returned 1 [0236.682] CloseHandle (hObject=0x370) returned 1 [0236.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0236.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.682] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0236.682] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0236.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0236.684] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0236.684] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0236.684] ReadFile (in: hFile=0x370, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x621, lpOverlapped=0x0) returned 1 [0236.686] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x630, dwBufLen=0x630 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x630) returned 1 [0236.686] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x630, lpOverlapped=0x0) returned 1 [0236.686] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0236.686] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0236.686] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0236.687] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0236.687] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0236.687] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0236.687] CloseHandle (hObject=0x370) returned 1 [0236.687] CloseHandle (hObject=0x374) returned 1 [0236.688] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0236.689] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0236.689] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=25234) returned 1 [0236.689] CloseHandle (hObject=0x374) returned 1 [0236.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0236.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0236.690] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0236.690] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0236.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.690] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0236.690] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0236.690] ReadFile (in: hFile=0x374, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x6292, lpOverlapped=0x0) returned 1 [0236.692] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x62a0, dwBufLen=0x62a0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x62a0) returned 1 [0236.692] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x62a0, lpOverlapped=0x0) returned 1 [0236.693] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0236.693] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0236.693] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0236.693] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0236.693] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0236.693] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0236.693] CloseHandle (hObject=0x374) returned 1 [0236.693] CloseHandle (hObject=0x370) returned 1 [0236.694] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0236.695] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0236.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.696] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2985) returned 1 [0236.696] CloseHandle (hObject=0x370) returned 1 [0236.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0236.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0236.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.696] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0236.696] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0236.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0236.988] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0236.988] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0236.988] ReadFile (in: hFile=0x370, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0xba9, lpOverlapped=0x0) returned 1 [0237.392] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xbb0) returned 1 [0237.392] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xbb0, lpOverlapped=0x0) returned 1 [0237.400] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2e70) returned 1 [0237.400] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0237.400] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0237.405] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0237.405] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0237.405] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0237.405] CloseHandle (hObject=0x370) returned 1 [0237.405] CloseHandle (hObject=0x398) returned 1 [0237.406] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0237.407] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0237.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0237.408] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2848) returned 1 [0237.408] CloseHandle (hObject=0x398) returned 1 [0237.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0237.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0237.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0237.408] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0237.408] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0237.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0237.979] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2f70) returned 1 [0237.979] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0237.979] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0xb20, lpOverlapped=0x0) returned 1 [0238.025] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xb30, dwBufLen=0xb30 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xb30) returned 1 [0238.025] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xb30, lpOverlapped=0x0) returned 1 [0238.026] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2eb0) returned 1 [0238.026] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.026] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.026] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.026] WriteFile (in: hFile=0x374, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.026] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.026] CloseHandle (hObject=0x398) returned 1 [0238.026] CloseHandle (hObject=0x374) returned 1 [0238.027] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0238.028] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.031] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=20627) returned 1 [0238.031] CloseHandle (hObject=0x398) returned 1 [0238.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0238.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.031] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.031] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.032] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2f70) returned 1 [0238.032] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.032] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x5093, lpOverlapped=0x0) returned 1 [0238.033] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50a0, dwBufLen=0x50a0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x50a0) returned 1 [0238.033] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x50a0, lpOverlapped=0x0) returned 1 [0238.034] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2eb0) returned 1 [0238.034] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.034] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.034] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.035] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.035] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.035] CloseHandle (hObject=0x398) returned 1 [0238.035] CloseHandle (hObject=0x340) returned 1 [0238.035] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0238.036] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.037] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1560) returned 1 [0238.037] CloseHandle (hObject=0x340) returned 1 [0238.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0238.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.037] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.037] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.039] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2f70) returned 1 [0238.039] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.039] ReadFile (in: hFile=0x340, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x618, lpOverlapped=0x0) returned 1 [0238.040] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x620, dwBufLen=0x620 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x620) returned 1 [0238.040] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x620, lpOverlapped=0x0) returned 1 [0238.041] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2eb0) returned 1 [0238.041] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.041] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.041] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.041] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.041] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.041] CloseHandle (hObject=0x340) returned 1 [0238.041] CloseHandle (hObject=0x380) returned 1 [0238.042] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0238.043] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.043] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=33009) returned 1 [0238.043] CloseHandle (hObject=0x380) returned 1 [0238.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0238.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.044] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.044] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.044] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2f70) returned 1 [0238.044] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.044] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x80f1, lpOverlapped=0x0) returned 1 [0238.046] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x8100, dwBufLen=0x8100 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x8100) returned 1 [0238.046] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x8100, lpOverlapped=0x0) returned 1 [0238.047] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2cb0) returned 1 [0238.047] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.047] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.048] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.048] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.048] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.048] CloseHandle (hObject=0x380) returned 1 [0238.048] CloseHandle (hObject=0x340) returned 1 [0238.049] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0238.050] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.050] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1925) returned 1 [0238.050] CloseHandle (hObject=0x340) returned 1 [0238.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0238.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.050] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.050] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.053] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2f70) returned 1 [0238.053] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.053] ReadFile (in: hFile=0x340, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x785, lpOverlapped=0x0) returned 1 [0238.055] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x790, dwBufLen=0x790 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x790) returned 1 [0238.055] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x790, lpOverlapped=0x0) returned 1 [0238.057] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2cb0) returned 1 [0238.057] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.057] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.057] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.057] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.057] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.057] CloseHandle (hObject=0x340) returned 1 [0238.058] CloseHandle (hObject=0x380) returned 1 [0238.058] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0238.059] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.060] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=27407) returned 1 [0238.060] CloseHandle (hObject=0x380) returned 1 [0238.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0238.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.060] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.060] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.061] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2f70) returned 1 [0238.061] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.061] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x6b0f, lpOverlapped=0x0) returned 1 [0238.063] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x6b10) returned 1 [0238.063] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x6b10, lpOverlapped=0x0) returned 1 [0238.064] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2cb0) returned 1 [0238.064] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.064] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.064] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.064] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.064] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.064] CloseHandle (hObject=0x380) returned 1 [0238.064] CloseHandle (hObject=0x340) returned 1 [0238.065] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0238.066] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.067] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=3479) returned 1 [0238.067] CloseHandle (hObject=0x340) returned 1 [0238.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0238.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0238.067] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.067] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.405] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2eb0) returned 1 [0238.405] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.405] ReadFile (in: hFile=0x340, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0xd97, lpOverlapped=0x0) returned 1 [0238.421] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xda0, dwBufLen=0xda0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xda0) returned 1 [0238.421] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xda0, lpOverlapped=0x0) returned 1 [0238.422] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2e70) returned 1 [0238.422] CryptSetKeyParam (hKey=0x5a2e70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.422] CryptEncrypt (in: hKey=0x5a2e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.422] CryptDestroyKey (hKey=0x5a2e70) returned 1 [0238.422] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.423] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0238.423] CloseHandle (hObject=0x340) returned 1 [0238.423] CloseHandle (hObject=0x398) returned 1 [0238.423] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0238.424] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.425] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2722) returned 1 [0238.425] CloseHandle (hObject=0x398) returned 1 [0238.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0238.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.425] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.425] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0238.535] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0238.535] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.535] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0xaa2, lpOverlapped=0x0) returned 1 [0238.537] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xab0, dwBufLen=0xab0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xab0) returned 1 [0238.537] WriteFile (in: hFile=0x348, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xab0, lpOverlapped=0x0) returned 1 [0238.539] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0238.539] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.539] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.539] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.539] WriteFile (in: hFile=0x348, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.539] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.539] CloseHandle (hObject=0x398) returned 1 [0238.539] CloseHandle (hObject=0x348) returned 1 [0238.543] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0238.544] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0238.545] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=945) returned 1 [0238.545] CloseHandle (hObject=0x348) returned 1 [0238.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0238.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0238.545] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.545] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.547] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0238.547] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.547] ReadFile (in: hFile=0x348, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x3b1, lpOverlapped=0x0) returned 1 [0238.548] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x3c0) returned 1 [0238.548] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x3c0, lpOverlapped=0x0) returned 1 [0238.549] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0238.549] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.549] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.549] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.549] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.550] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.550] CloseHandle (hObject=0x348) returned 1 [0238.550] CloseHandle (hObject=0x398) returned 1 [0238.550] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0238.551] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.552] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=32607) returned 1 [0238.552] CloseHandle (hObject=0x398) returned 1 [0238.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0238.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0238.552] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.552] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0238.552] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0238.552] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.552] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x7f5f, lpOverlapped=0x0) returned 1 [0238.554] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7f60, dwBufLen=0x7f60 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7f60) returned 1 [0238.554] WriteFile (in: hFile=0x348, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x7f60, lpOverlapped=0x0) returned 1 [0238.555] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0238.555] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.555] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.555] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.555] WriteFile (in: hFile=0x348, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.556] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.556] CloseHandle (hObject=0x398) returned 1 [0238.556] CloseHandle (hObject=0x348) returned 1 [0238.557] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0238.558] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0238.559] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2044) returned 1 [0238.559] CloseHandle (hObject=0x348) returned 1 [0238.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0238.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0238.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0238.559] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.559] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0238.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.561] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0238.561] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.561] ReadFile (in: hFile=0x348, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x7fc, lpOverlapped=0x0) returned 1 [0238.817] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x800, dwBufLen=0x800 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x800) returned 1 [0238.817] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x800, lpOverlapped=0x0) returned 1 [0238.818] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0238.818] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0238.818] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0238.818] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0238.818] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0238.819] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0238.819] CloseHandle (hObject=0x348) returned 1 [0238.819] CloseHandle (hObject=0x380) returned 1 [0238.820] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0238.821] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0238.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0238.992] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=20575) returned 1 [0239.007] CloseHandle (hObject=0x380) returned 1 [0239.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0239.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.007] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.008] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0239.008] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0239.008] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.008] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x505f, lpOverlapped=0x0) returned 1 [0239.010] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5060, dwBufLen=0x5060 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5060) returned 1 [0239.010] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5060, lpOverlapped=0x0) returned 1 [0239.011] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2cb0) returned 1 [0239.011] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.011] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0239.011] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0239.011] WriteFile (in: hFile=0x398, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0239.011] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.011] CloseHandle (hObject=0x380) returned 1 [0239.012] CloseHandle (hObject=0x398) returned 1 [0239.013] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0239.014] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0239.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.174] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=25106) returned 1 [0239.174] CloseHandle (hObject=0x390) returned 1 [0239.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0239.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.174] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.174] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.175] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0239.175] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.175] ReadFile (in: hFile=0x390, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x6212, lpOverlapped=0x0) returned 1 [0239.223] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x6220, dwBufLen=0x6220 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x6220) returned 1 [0239.223] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x6220, lpOverlapped=0x0) returned 1 [0239.224] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0239.224] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.224] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0239.224] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.224] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0239.224] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0239.224] CloseHandle (hObject=0x390) returned 1 [0239.224] CloseHandle (hObject=0x380) returned 1 [0239.225] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0239.226] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0239.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.227] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=32403) returned 1 [0239.227] CloseHandle (hObject=0x380) returned 1 [0239.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0239.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.227] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.227] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.229] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0239.229] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.229] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x7e93, lpOverlapped=0x0) returned 1 [0239.231] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7ea0, dwBufLen=0x7ea0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7ea0) returned 1 [0239.231] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x7ea0, lpOverlapped=0x0) returned 1 [0239.234] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0239.234] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.234] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0239.234] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.234] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0239.234] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0239.234] CloseHandle (hObject=0x380) returned 1 [0239.235] CloseHandle (hObject=0x390) returned 1 [0239.235] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0239.236] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0239.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.237] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1347) returned 1 [0239.237] CloseHandle (hObject=0x390) returned 1 [0239.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0239.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.237] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.237] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.239] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0239.239] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.239] ReadFile (in: hFile=0x390, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x543, lpOverlapped=0x0) returned 1 [0239.241] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550, dwBufLen=0x550 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550) returned 1 [0239.241] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x550, lpOverlapped=0x0) returned 1 [0239.242] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0239.242] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.242] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0239.242] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.242] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0239.242] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0239.242] CloseHandle (hObject=0x390) returned 1 [0239.242] CloseHandle (hObject=0x380) returned 1 [0239.243] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0239.243] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0239.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.244] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=26402) returned 1 [0239.244] CloseHandle (hObject=0x380) returned 1 [0239.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0239.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.244] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.244] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.244] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0239.244] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.244] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x6722, lpOverlapped=0x0) returned 1 [0239.246] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x6730, dwBufLen=0x6730 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x6730) returned 1 [0239.246] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x6730, lpOverlapped=0x0) returned 1 [0239.247] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0239.247] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.247] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0239.247] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.247] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0239.248] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0239.248] CloseHandle (hObject=0x380) returned 1 [0239.248] CloseHandle (hObject=0x390) returned 1 [0239.248] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0239.249] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0239.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.250] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1354) returned 1 [0239.250] CloseHandle (hObject=0x390) returned 1 [0239.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0239.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.250] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.250] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.252] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0239.252] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.252] ReadFile (in: hFile=0x390, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x54a, lpOverlapped=0x0) returned 1 [0239.253] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550, dwBufLen=0x550 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x550) returned 1 [0239.253] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x550, lpOverlapped=0x0) returned 1 [0239.254] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2ef0) returned 1 [0239.254] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.254] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0239.254] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0239.254] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0239.254] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0239.254] CloseHandle (hObject=0x390) returned 1 [0239.254] CloseHandle (hObject=0x380) returned 1 [0239.255] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0239.256] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0239.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.256] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=32433) returned 1 [0239.256] CloseHandle (hObject=0x380) returned 1 [0239.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0239.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0239.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0239.257] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.257] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0239.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0239.257] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0239.257] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0239.257] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x7eb1, lpOverlapped=0x0) returned 1 [0240.828] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7ec0, dwBufLen=0x7ec0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x7ec0) returned 1 [0240.828] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x7ec0, lpOverlapped=0x0) returned 1 [0240.909] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0240.909] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0240.909] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0240.909] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0240.909] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0240.909] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0240.909] CloseHandle (hObject=0x380) returned 1 [0240.910] CloseHandle (hObject=0x390) returned 1 [0240.911] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0240.912] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0240.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.018] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=60724) returned 1 [0241.018] CloseHandle (hObject=0x340) returned 1 [0241.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0241.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.018] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0241.019] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0241.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.038] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0241.038] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0241.038] ReadFile (in: hFile=0x340, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0xed34, lpOverlapped=0x0) returned 1 [0241.057] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xed40, dwBufLen=0xed40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0xed40) returned 1 [0241.057] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xed40, lpOverlapped=0x0) returned 1 [0241.059] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2cb0) returned 1 [0241.059] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0241.059] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0241.059] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.059] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0241.059] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.059] CloseHandle (hObject=0x340) returned 1 [0241.059] CloseHandle (hObject=0x390) returned 1 [0241.063] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0241.065] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0241.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0241.258] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=33559) returned 1 [0241.258] CloseHandle (hObject=0x39c) returned 1 [0241.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0241.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0241.258] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0241.258] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0241.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.258] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2ef0) returned 1 [0241.258] CryptSetKeyParam (hKey=0x5a2ef0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0241.259] ReadFile (in: hFile=0x39c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x8317, lpOverlapped=0x0) returned 1 [0241.260] CryptEncrypt (in: hKey=0x5a2ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x8320, dwBufLen=0x8320 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x8320) returned 1 [0241.261] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x8320, lpOverlapped=0x0) returned 1 [0241.262] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2cb0) returned 1 [0241.262] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0241.262] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0241.262] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.262] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0241.262] CryptDestroyKey (hKey=0x5a2ef0) returned 1 [0241.262] CloseHandle (hObject=0x39c) returned 1 [0241.262] CloseHandle (hObject=0x390) returned 1 [0241.263] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0241.264] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0241.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.264] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=2476) returned 1 [0241.264] CloseHandle (hObject=0x390) returned 1 [0241.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0241.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.264] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0241.265] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0241.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.922] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2cb0) returned 1 [0241.922] CryptSetKeyParam (hKey=0x5a2cb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0241.922] ReadFile (in: hFile=0x390, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x9ac, lpOverlapped=0x0) returned 1 [0241.923] CryptEncrypt (in: hKey=0x5a2cb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x9b0) returned 1 [0241.923] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x9b0, lpOverlapped=0x0) returned 1 [0241.924] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0241.924] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0241.924] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0241.924] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0241.924] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0241.924] CryptDestroyKey (hKey=0x5a2cb0) returned 1 [0241.924] CloseHandle (hObject=0x390) returned 1 [0241.924] CloseHandle (hObject=0x340) returned 1 [0241.925] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0241.926] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0241.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.926] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1232) returned 1 [0241.926] CloseHandle (hObject=0x340) returned 1 [0241.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0241.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0241.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.926] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0241.926] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0241.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0242.081] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2eb0) returned 1 [0242.081] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0242.081] ReadFile (in: hFile=0x340, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x4d0, lpOverlapped=0x0) returned 1 [0242.082] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x4e0, dwBufLen=0x4e0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x4e0) returned 1 [0242.083] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x4e0, lpOverlapped=0x0) returned 1 [0242.084] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0242.084] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0242.084] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0242.084] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0242.084] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0242.084] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.084] CloseHandle (hObject=0x340) returned 1 [0242.084] CloseHandle (hObject=0x380) returned 1 [0242.084] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0242.085] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0242.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0242.087] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=16738) returned 1 [0242.087] CloseHandle (hObject=0x380) returned 1 [0242.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0242.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0242.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0242.088] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0242.088] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0242.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.088] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2eb0) returned 1 [0242.088] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0242.088] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x4162, lpOverlapped=0x0) returned 1 [0242.094] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x4170, dwBufLen=0x4170 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x4170) returned 1 [0242.094] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x4170, lpOverlapped=0x0) returned 1 [0242.095] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0242.095] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0242.095] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0242.095] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0242.095] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0242.095] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.095] CloseHandle (hObject=0x380) returned 1 [0242.095] CloseHandle (hObject=0x340) returned 1 [0242.096] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0242.097] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0242.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.097] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1439) returned 1 [0242.097] CloseHandle (hObject=0x340) returned 1 [0242.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0242.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0242.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.097] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0242.097] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0242.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0242.099] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2eb0) returned 1 [0242.099] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0242.099] ReadFile (in: hFile=0x340, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x59f, lpOverlapped=0x0) returned 1 [0242.101] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x5a0) returned 1 [0242.101] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x5a0, lpOverlapped=0x0) returned 1 [0242.102] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0242.102] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0242.102] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0242.102] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0242.102] WriteFile (in: hFile=0x380, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0242.102] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.102] CloseHandle (hObject=0x340) returned 1 [0242.102] CloseHandle (hObject=0x380) returned 1 [0242.102] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0242.103] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0242.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0242.104] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=37112) returned 1 [0242.104] CloseHandle (hObject=0x380) returned 1 [0242.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0242.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0242.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0242.104] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0242.104] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0242.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.104] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe74 | out: phKey=0x334fe74*=0x5a2eb0) returned 1 [0242.105] CryptSetKeyParam (hKey=0x5a2eb0, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0242.105] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x334fe9c*=0x90f8, lpOverlapped=0x0) returned 1 [0242.106] CryptEncrypt (in: hKey=0x5a2eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x9100, dwBufLen=0x9100 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x9100) returned 1 [0242.106] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0x9100, lpOverlapped=0x0) returned 1 [0242.108] CryptImportKey (in: hProv=0x5a37b8, pbData=0x334fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fe78 | out: phKey=0x334fe78*=0x5a2f70) returned 1 [0242.108] CryptSetKeyParam (hKey=0x5a2f70, dwParam=0x1, pbData=0x334ff28, dwFlags=0x0) returned 1 [0242.108] CryptEncrypt (in: hKey=0x5a2f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40, dwBufLen=0x40 | out: pbData=0x3a60020*, pdwDataLen=0x334fe38*=0x40) returned 1 [0242.108] CryptDestroyKey (hKey=0x5a2f70) returned 1 [0242.108] WriteFile (in: hFile=0x340, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fe80, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x334fe80*=0xf2, lpOverlapped=0x0) returned 1 [0242.108] CryptDestroyKey (hKey=0x5a2eb0) returned 1 [0242.108] CloseHandle (hObject=0x380) returned 1 [0242.108] CloseHandle (hObject=0x340) returned 1 [0242.108] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0242.109] CryptGenRandom (in: hProv=0x5a37b8, dwLen=0x10, pbBuffer=0x334ff28 | out: pbBuffer=0x334ff28) returned 1 [0242.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.110] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x334fec0 | out: lpFileSize=0x334fec0*=1666) returned 1 [0242.110] CloseHandle (hObject=0x340) returned 1 [0242.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0242.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor")) returned 0xffffffff [0242.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.111] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0242.111] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fe60 | out: lpNewFilePointer=0x0) returned 1 [0242.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id[9C354B42-2222].[William_Kidd_2019@protonmail.com].actor" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id[9c354b42-2222].[william_kidd_2019@protonmail.com].actor"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3b0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 10 os_tid = 0x4a0 Thread: id = 11 os_tid = 0x85c Thread: id = 12 os_tid = 0x40c Thread: id = 13 os_tid = 0x818 Thread: id = 14 os_tid = 0x858 Thread: id = 15 os_tid = 0x15c Thread: id = 16 os_tid = 0x110 Thread: id = 17 os_tid = 0xbc8 Thread: id = 18 os_tid = 0xbc4 Thread: id = 19 os_tid = 0xaf0 Thread: id = 20 os_tid = 0xae8 Thread: id = 21 os_tid = 0xab4 Thread: id = 22 os_tid = 0xa4c Thread: id = 23 os_tid = 0xa48 Thread: id = 24 os_tid = 0xa40 Thread: id = 25 os_tid = 0x7cc Thread: id = 26 os_tid = 0x430 Thread: id = 27 os_tid = 0x268 Thread: id = 28 os_tid = 0x70c Thread: id = 29 os_tid = 0x6c0 Thread: id = 30 os_tid = 0x6a4 Thread: id = 31 os_tid = 0x6a0 Thread: id = 32 os_tid = 0x690 Thread: id = 33 os_tid = 0x67c Thread: id = 34 os_tid = 0x490 Thread: id = 35 os_tid = 0x454 Thread: id = 36 os_tid = 0x450 Thread: id = 37 os_tid = 0x428 Thread: id = 38 os_tid = 0x420 Thread: id = 39 os_tid = 0x404 Thread: id = 40 os_tid = 0xf0 Thread: id = 41 os_tid = 0x3f0 Thread: id = 42 os_tid = 0x3e4 Thread: id = 43 os_tid = 0x398 Thread: id = 44 os_tid = 0x394 Thread: id = 45 os_tid = 0x378 Thread: id = 46 os_tid = 0x370 Thread: id = 47 os_tid = 0x7ec Thread: id = 51 os_tid = 0x850 Thread: id = 54 os_tid = 0x5c4 Thread: id = 55 os_tid = 0x35c Thread: id = 56 os_tid = 0x6f8 Thread: id = 104 os_tid = 0x984 Thread: id = 123 os_tid = 0x224 Process: id = "4" image_name = "nslookup.exe" filename = "c:\\windows\\syswow64\\nslookup.exe" page_root = "0x3a36d000" os_pid = "0x844" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3b0" cmd_line = "\"C:\\Windows\\SysWOW64\\nslookup.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0x848 [0210.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9f9a0 | out: lpSystemTimeAsFileTime=0x9f9a0*(dwLowDateTime=0x31f55520, dwHighDateTime=0x1d52864)) [0210.475] GetCurrentProcessId () returned 0x844 [0210.475] GetCurrentThreadId () returned 0x848 [0210.475] GetTickCount () returned 0x416ca [0210.475] QueryPerformanceCounter (in: lpPerformanceCount=0x9f998 | out: lpPerformanceCount=0x9f998*=33059047459) returned 1 [0210.476] GetModuleHandleA (lpModuleName=0x0) returned 0xda0000 [0210.476] __set_app_type (_Type=0x1) [0210.476] __p__fmode () returned 0x74eb31f4 [0210.476] __p__commode () returned 0x74eb31fc [0210.476] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xdacceb) returned 0x0 [0210.477] __getmainargs (in: _Argc=0xdba0ac, _Argv=0xdba0b4, _Env=0xdba0b0, _DoWildCard=0, _StartInfo=0xdba0c0 | out: _Argc=0xdba0ac, _Argv=0xdba0b4, _Env=0xdba0b0) returned 0 [0210.477] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0210.477] SetThreadUILanguage (LangId=0x0) returned 0x409 [0210.477] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdbaa60 | out: lpWSAData=0xdbaa60) returned 0 [0210.485] malloc (_Size=0x40) returned 0x2412c8 [0210.485] socket (af=2, type=2, protocol=0) returned 0x88 [0210.507] closesocket (s=0x88) returned 0 [0210.507] RtlIpv4StringToAddressA () returned 0x0 [0210.507] RtlInitString (in: DestinationString=0x9f8ac, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0210.507] RtlAnsiStringToUnicodeString (in: DestinationString=0x9f8b4, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0210.507] NtOpenKey (in: KeyHandle=0x9f8ec, DesiredAccess=0x20019, ObjectAttributes=0x9f894*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x9f8ec*=0x88) returned 0x0 [0210.507] RtlFreeAnsiString (AnsiString="\\") [0210.507] malloc (_Size=0x3200) returned 0x2424a8 [0210.507] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48a6e0 [0210.508] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48aae8 [0210.508] RtlAnsiStringToUnicodeString (in: DestinationString=0x9f8a4, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0210.508] NtQueryValueKey (in: KeyHandle=0x88, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x48a6e0, Length=0x400, ResultLength=0x9f8ac | out: KeyValueInformation=0x48a6e0, ResultLength=0x9f8ac) returned 0xc0000034 [0210.508] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48aae8) returned 1 [0210.508] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48a6e0) returned 1 [0210.508] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48a6e0 [0210.508] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48aae8 [0210.508] RtlAnsiStringToUnicodeString (in: DestinationString=0x9f8a4, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0210.508] NtQueryValueKey (in: KeyHandle=0x88, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x48a6e0, Length=0x400, ResultLength=0x9f8ac | out: KeyValueInformation=0x48a6e0*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x9f8ac) returned 0x0 [0210.508] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48aae8) returned 1 [0210.508] RtlUnicodeStringToAnsiString (in: DestinationString=0x9f89c, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0210.508] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48a6e0) returned 1 [0210.508] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48a6e0 [0210.508] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48aae8 [0210.508] RtlAnsiStringToUnicodeString (in: DestinationString=0x9f8a4, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0210.508] NtQueryValueKey (in: KeyHandle=0x88, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x48a6e0, Length=0x400, ResultLength=0x9f8ac | out: KeyValueInformation=0x48a6e0, ResultLength=0x9f8ac) returned 0xc0000034 [0210.508] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48aae8) returned 1 [0210.508] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48a6e0) returned 1 [0210.508] RtlInitString (in: DestinationString=0x9f8ac, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0210.508] RtlAnsiStringToUnicodeString (in: DestinationString=0x9f8b4, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0210.508] NtOpenKey (in: KeyHandle=0x9f8dc, DesiredAccess=0x20019, ObjectAttributes=0x9f894*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x9f8dc*=0x0) returned 0xc0000034 [0210.508] RtlFreeAnsiString (AnsiString="\\") [0210.508] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48a6e0 [0210.508] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48aae8 [0210.508] RtlAnsiStringToUnicodeString (in: DestinationString=0x9f8a4, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0210.508] NtQueryValueKey (in: KeyHandle=0x88, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x48a6e0, Length=0x400, ResultLength=0x9f8ac | out: KeyValueInformation=0x48a6e0*(TitleIndex=0x0, Type=0x1, DataOffset=0x28, DataLength=0x2, NameLength=0x14, Name="SearchList", Data=""), ResultLength=0x9f8ac) returned 0x0 [0210.508] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48aae8) returned 1 [0210.508] RtlUnicodeStringToAnsiString (in: DestinationString=0x9f89c, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0210.508] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48a6e0) returned 1 [0210.508] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48a6e0 [0210.509] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x400) returned 0x48aae8 [0210.509] RtlAnsiStringToUnicodeString (in: DestinationString=0x9f8a4, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0210.509] NtQueryValueKey (in: KeyHandle=0x88, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x48a6e0, Length=0x400, ResultLength=0x9f8ac | out: KeyValueInformation=0x48a6e0, ResultLength=0x9f8ac) returned 0xc0000034 [0210.509] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48aae8) returned 1 [0210.509] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x48a6e0) returned 1 [0210.509] gethostname (in: name=0x2424a8, namelen=12800 | out: name="XDuwTfOno") returned 0 [0210.834] free (_Block=0x2424a8) [0210.834] malloc (_Size=0x10) returned 0x241398 [0210.835] getenv (_VarName="HOME") returned 0x0 [0210.835] DnsQueryConfigAllocEx () returned 0x1b0a90 [0211.199] _vsnprintf (in: _DstBuf=0x9f7e4, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x8f7b0 | out: _DstBuf="1.0.168.192.in-addr.arpa.") returned 25 [0211.199] htons (hostshort=0x1) returned 0x100 [0211.199] htons (hostshort=0x1) returned 0x100 [0211.200] socket (af=2, type=2, protocol=0) returned 0x12c [0211.201] connect (s=0x12c, name=0x1b0ab0*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0211.201] send (s=0x12c, buf=0x8f7e4*, len=42, flags=0) returned 42 [0211.202] select (in: nfds=300, readfds=0x7f404, writefds=0x0, exceptfds=0x0, timeout=0x7f510 | out: readfds=0x7f404, writefds=0x0, exceptfds=0x0) returned 1 [0211.203] recv (in: s=0x12c, buf=0x7f7b0, len=65536, flags=0 | out: buf=0x7f7b0*) returned 101 [0211.203] closesocket (s=0x12c) returned 0 [0211.203] RtlIpv4AddressToStringExA () returned 0xc000000d [0211.203] DnsFreeConfigStructure () returned 0x1 [0211.203] malloc (_Size=0xc) returned 0x2413b0 [0211.203] strcpy_s (in: _Dst=0x2413b0, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0211.203] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x49a2b0 [0211.203] strcpy_s (in: _Dst=0xdbac00, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0211.203] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2b, dwLanguageId=0x0, lpBuffer=0x9f8c8, nSize=0x0, Arguments=0x9f8cc | out: lpBuffer="\xb0\x97\x49") returned 0xf [0211.203] fprintf (in: _File=0x74eb2920, _Format="%-7s %s" | out: _File=0x74eb2920) returned 24 [0211.205] fprintf (in: _File=0x74eb2920, _Format="\nAddress:" | out: _File=0x74eb2920) returned 9 [0211.205] inet_ntoa (in=0x100a8c0) returned="192.168.0.1" [0211.205] fprintf (in: _File=0x74eb2920, _Format="%c %s" | out: _File=0x74eb2920) returned 13 [0211.206] fprintf (in: _File=0x74eb2920, _Format="\n\n" | out: _File=0x74eb2920) returned 2 [0211.206] printf (_Format="> ") returned 2 [0211.207] fflush (in: _File=0x74eb2920 | out: _File=0x74eb2920) returned 0 [0211.207] malloc (_Size=0x28) returned 0x246ad8 [0211.207] malloc (_Size=0x4002) returned 0x246b08 [0211.207] fgetc (_File=0x74eb2900) Thread: id = 53 os_tid = 0x5f0 Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3b495000" os_pid = "0x62c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3b0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 59 os_tid = 0x5a4 [0215.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bf8f0 | out: lpSystemTimeAsFileTime=0x1bf8f0*(dwLowDateTime=0x346e82e0, dwHighDateTime=0x1d52864)) [0215.195] GetCurrentProcessId () returned 0x62c [0215.195] GetCurrentThreadId () returned 0x5a4 [0215.195] GetTickCount () returned 0x42700 [0215.195] QueryPerformanceCounter (in: lpPerformanceCount=0x1bf8f8 | out: lpPerformanceCount=0x1bf8f8*=33531002237) returned 1 [0215.196] GetModuleHandleW (lpModuleName=0x0) returned 0x49df0000 [0215.197] __set_app_type (_Type=0x1) [0215.197] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e17810) returned 0x0 [0215.197] __getmainargs (in: _Argc=0x49e3a608, _Argv=0x49e3a618, _Env=0x49e3a610, _DoWildCard=0, _StartInfo=0x49e1e0f4 | out: _Argc=0x49e3a608, _Argv=0x49e3a618, _Env=0x49e3a610) returned 0 [0215.197] GetCurrentThreadId () returned 0x5a4 [0215.197] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5a4) returned 0x3c [0215.197] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0215.197] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0215.197] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0215.197] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0215.197] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bf888 | out: phkResult=0x1bf888*=0x0) returned 0x2 [0215.198] VirtualQuery (in: lpAddress=0x1bf870, lpBuffer=0x1bf7f0, dwLength=0x30 | out: lpBuffer=0x1bf7f0*(BaseAddress=0x1bf000, AllocationBase=0xc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0215.198] VirtualQuery (in: lpAddress=0xc0000, lpBuffer=0x1bf7f0, dwLength=0x30 | out: lpBuffer=0x1bf7f0*(BaseAddress=0xc0000, AllocationBase=0xc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0215.198] VirtualQuery (in: lpAddress=0xc1000, lpBuffer=0x1bf7f0, dwLength=0x30 | out: lpBuffer=0x1bf7f0*(BaseAddress=0xc1000, AllocationBase=0xc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0215.198] VirtualQuery (in: lpAddress=0xc4000, lpBuffer=0x1bf7f0, dwLength=0x30 | out: lpBuffer=0x1bf7f0*(BaseAddress=0xc4000, AllocationBase=0xc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0215.198] VirtualQuery (in: lpAddress=0x1c0000, lpBuffer=0x1bf7f0, dwLength=0x30 | out: lpBuffer=0x1bf7f0*(BaseAddress=0x1c0000, AllocationBase=0x1c0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x7000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0215.198] GetConsoleOutputCP () returned 0x1b5 [0215.198] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e2bfe0 | out: lpCPInfo=0x49e2bfe0) returned 1 [0215.198] SetConsoleCtrlHandler (HandlerRoutine=0x49e13184, Add=1) returned 1 [0215.198] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.198] SetConsoleMode (hConsoleHandle=0x294, dwMode=0x0) returned 0 [0215.198] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.198] GetConsoleMode (in: hConsoleHandle=0x294, lpMode=0x49e1e194 | out: lpMode=0x49e1e194) returned 0 [0215.199] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.199] GetConsoleMode (in: hConsoleHandle=0x284, lpMode=0x49e1e198 | out: lpMode=0x49e1e198) returned 0 [0215.199] GetEnvironmentStringsW () returned 0x238a60* [0215.199] GetProcessHeap () returned 0x220000 [0215.199] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xa7c) returned 0x2394f0 [0215.199] FreeEnvironmentStringsW (penv=0x238a60) returned 1 [0215.199] GetProcessHeap () returned 0x220000 [0215.199] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x8) returned 0x2388e0 [0215.199] GetEnvironmentStringsW () returned 0x238a60* [0215.199] GetProcessHeap () returned 0x220000 [0215.199] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xa7c) returned 0x239f80 [0215.199] FreeEnvironmentStringsW (penv=0x238a60) returned 1 [0215.199] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1be748 | out: phkResult=0x1be748*=0x44) returned 0x0 [0215.199] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x0, lpData=0x1be760*=0x18, lpcbData=0x1be744*=0x1000) returned 0x2 [0215.199] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x4, lpData=0x1be760*=0x1, lpcbData=0x1be744*=0x4) returned 0x0 [0215.199] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x0, lpData=0x1be760*=0x1, lpcbData=0x1be744*=0x1000) returned 0x2 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x4, lpData=0x1be760*=0x0, lpcbData=0x1be744*=0x4) returned 0x0 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x4, lpData=0x1be760*=0x40, lpcbData=0x1be744*=0x4) returned 0x0 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x4, lpData=0x1be760*=0x40, lpcbData=0x1be744*=0x4) returned 0x0 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x0, lpData=0x1be760*=0x40, lpcbData=0x1be744*=0x1000) returned 0x2 [0215.200] RegCloseKey (hKey=0x44) returned 0x0 [0215.200] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1be748 | out: phkResult=0x1be748*=0x44) returned 0x0 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x0, lpData=0x1be760*=0x40, lpcbData=0x1be744*=0x1000) returned 0x2 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x4, lpData=0x1be760*=0x1, lpcbData=0x1be744*=0x4) returned 0x0 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x0, lpData=0x1be760*=0x1, lpcbData=0x1be744*=0x1000) returned 0x2 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x4, lpData=0x1be760*=0x0, lpcbData=0x1be744*=0x4) returned 0x0 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x4, lpData=0x1be760*=0x9, lpcbData=0x1be744*=0x4) returned 0x0 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x4, lpData=0x1be760*=0x9, lpcbData=0x1be744*=0x4) returned 0x0 [0215.200] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1be740, lpData=0x1be760, lpcbData=0x1be744*=0x1000 | out: lpType=0x1be740*=0x0, lpData=0x1be760*=0x9, lpcbData=0x1be744*=0x1000) returned 0x2 [0215.200] RegCloseKey (hKey=0x44) returned 0x0 [0215.200] time (in: timer=0x0 | out: timer=0x0) returned 0x5d0d2a53 [0215.200] srand (_Seed=0x5d0d2a53) [0215.200] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0215.200] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0215.200] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e2c0a0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0215.201] GetProcessHeap () returned 0x220000 [0215.201] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x218) returned 0x23aa10 [0215.201] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0215.201] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0215.201] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0215.201] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0215.201] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0215.201] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0215.201] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0215.201] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0215.201] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0215.201] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0215.201] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0215.201] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0215.201] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0215.201] GetProcessHeap () returned 0x220000 [0215.201] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2394f0 | out: hHeap=0x220000) returned 1 [0215.201] GetEnvironmentStringsW () returned 0x238a60* [0215.201] GetProcessHeap () returned 0x220000 [0215.201] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xa94) returned 0x23ac30 [0215.201] FreeEnvironmentStringsW (penv=0x238a60) returned 1 [0215.201] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0215.201] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0215.201] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0215.201] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0215.202] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0215.202] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0215.202] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0215.202] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0215.202] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0215.202] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0215.202] GetProcessHeap () returned 0x220000 [0215.202] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x5a) returned 0x23b6d0 [0215.202] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1bf550 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0215.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", nBufferLength=0x104, lpBuffer=0x1bf550, lpFilePart=0x1bf530 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFilePart=0x1bf530*="Temp") returned 0x24 [0215.202] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0215.202] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1bf260 | out: lpFindFileData=0x1bf260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x23b740 [0215.202] FindClose (in: hFindFile=0x23b740 | out: hFindFile=0x23b740) returned 1 [0215.202] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1", lpFindFileData=0x1bf260 | out: lpFindFileData=0x1bf260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x23b740 [0215.202] FindClose (in: hFindFile=0x23b740 | out: hFindFile=0x23b740) returned 1 [0215.202] _wcsnicmp (_String1="5P5NRG~1", _String2="5P5NRG~1", _MaxCount=0x8) returned 0 [0215.202] _wcsicmp (_String1="5p5NrGJn0jS HALPmcxz", _String2="5P5NRG~1") returned -20 [0215.202] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData", lpFindFileData=0x1bf260 | out: lpFindFileData=0x1bf260*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="AppData", cAlternateFileName="")) returned 0x23b740 [0215.203] FindClose (in: hFindFile=0x23b740 | out: hFindFile=0x23b740) returned 1 [0215.203] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local", lpFindFileData=0x1bf260 | out: lpFindFileData=0x1bf260*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x344ace40, ftLastAccessTime.dwHighDateTime=0x1d52864, ftLastWriteTime.dwLowDateTime=0x344ace40, ftLastWriteTime.dwHighDateTime=0x1d52864, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Local", cAlternateFileName="")) returned 0x23b740 [0215.203] FindClose (in: hFindFile=0x23b740 | out: hFindFile=0x23b740) returned 1 [0215.203] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFindFileData=0x1bf260 | out: lpFindFileData=0x1bf260*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x32f40840, ftLastAccessTime.dwHighDateTime=0x1d52864, ftLastWriteTime.dwLowDateTime=0x32f40840, ftLastWriteTime.dwHighDateTime=0x1d52864, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Temp", cAlternateFileName="")) returned 0x23b740 [0215.203] FindClose (in: hFindFile=0x23b740 | out: hFindFile=0x23b740) returned 1 [0215.203] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0215.203] SetCurrentDirectoryW (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 1 [0215.203] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 1 [0215.203] GetProcessHeap () returned 0x220000 [0215.203] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ac30 | out: hHeap=0x220000) returned 1 [0215.203] GetEnvironmentStringsW () returned 0x23b740* [0215.203] GetProcessHeap () returned 0x220000 [0215.203] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xae6) returned 0x23c230 [0215.203] FreeEnvironmentStringsW (penv=0x23b740) returned 1 [0215.203] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e2c0a0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0215.203] GetProcessHeap () returned 0x220000 [0215.203] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b6d0 | out: hHeap=0x220000) returned 1 [0215.203] GetProcessHeap () returned 0x220000 [0215.203] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x4016) returned 0x23cd20 [0215.204] GetProcessHeap () returned 0x220000 [0215.204] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20 | out: hHeap=0x220000) returned 1 [0215.204] GetConsoleOutputCP () returned 0x1b5 [0215.204] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e2bfe0 | out: lpCPInfo=0x49e2bfe0) returned 1 [0215.204] GetUserDefaultLCID () returned 0x409 [0215.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e27b50, cchData=8 | out: lpLCData=":") returned 2 [0215.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1bf660, cchData=128 | out: lpLCData="0") returned 2 [0215.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1bf660, cchData=128 | out: lpLCData="0") returned 2 [0215.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1bf660, cchData=128 | out: lpLCData="1") returned 2 [0215.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e3a740, cchData=8 | out: lpLCData="/") returned 2 [0215.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e3a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0215.205] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e3a460, cchData=32 | out: lpLCData="Tue") returned 4 [0215.205] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e3a420, cchData=32 | out: lpLCData="Wed") returned 4 [0215.205] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e3a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0215.205] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e3a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0215.205] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e3a360, cchData=32 | out: lpLCData="Sat") returned 4 [0215.205] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e3a700, cchData=32 | out: lpLCData="Sun") returned 4 [0215.205] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e27b40, cchData=8 | out: lpLCData=".") returned 2 [0215.205] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e3a4e0, cchData=8 | out: lpLCData=",") returned 2 [0215.205] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0215.205] GetProcessHeap () returned 0x220000 [0215.206] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20c) returned 0x2395c0 [0215.206] GetConsoleTitleW (in: lpConsoleTitle=0x2395c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0215.206] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.206] GetFileType (hFile=0x294) returned 0x3 [0215.206] BrandingFormatString () returned 0x2397e0 [0215.254] GetVersion () returned 0x1db10106 [0215.254] _vsnwprintf (in: _Buffer=0x1bf7d0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1bf768 | out: _Buffer="6.1.7601") returned 8 [0215.254] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.254] GetFileType (hFile=0x294) returned 0x3 [0215.254] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49e36340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0215.254] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49e36340, nSize=0x2000, Arguments=0x1bf770 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0215.254] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.254] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0215.254] WriteFile (in: hFile=0x294, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1bf6f8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1bf6f8*=0x24, lpOverlapped=0x0) returned 1 [0215.254] _vsnwprintf (in: _Buffer=0x49e36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1bf798 | out: _Buffer="\r\n") returned 2 [0215.254] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.254] GetFileType (hFile=0x294) returned 0x3 [0215.254] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.255] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0215.255] WriteFile (in: hFile=0x294, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1bf768, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1bf768*=0x2, lpOverlapped=0x0) returned 1 [0215.255] _vsnwprintf (in: _Buffer=0x49e36340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1bf798 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0215.255] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.255] GetFileType (hFile=0x294) returned 0x3 [0215.255] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.255] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0215.255] WriteFile (in: hFile=0x294, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1bf768, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1bf768*=0x3f, lpOverlapped=0x0) returned 1 [0215.255] _vsnwprintf (in: _Buffer=0x49e36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1bf798 | out: _Buffer="\r\n") returned 2 [0215.255] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.255] GetFileType (hFile=0x294) returned 0x3 [0215.255] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.255] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0215.255] WriteFile (in: hFile=0x294, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1bf768, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1bf768*=0x2, lpOverlapped=0x0) returned 1 [0215.255] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0215.255] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0215.255] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0215.255] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0215.255] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.255] GetFileType (hFile=0x284) returned 0x3 [0215.255] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0215.255] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1bf5c0 | out: TokenHandle=0x1bf5c0*=0x0) returned 0xc000007c [0215.256] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1bf5c0 | out: TokenHandle=0x1bf5c0*=0x50) returned 0x0 [0215.256] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1bf5d0, TokenInformationLength=0x4, ReturnLength=0x1bf5d8 | out: TokenInformation=0x1bf5d0, ReturnLength=0x1bf5d8) returned 0x0 [0215.256] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1bf5d8, TokenInformationLength=0x4, ReturnLength=0x1bf5d0 | out: TokenInformation=0x1bf5d8, ReturnLength=0x1bf5d0) returned 0x0 [0215.256] NtClose (Handle=0x50) returned 0x0 [0215.256] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1bf5a0, nSize=0x0, Arguments=0x1bf5a8 | out: lpBuffer="\x97e0\x23") returned 0xf [0215.256] GetProcessHeap () returned 0x220000 [0215.256] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x218) returned 0x221ab0 [0215.256] GetConsoleTitleW (in: lpConsoleTitle=0x1bf5f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0215.256] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0215.256] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0215.257] GetProcessHeap () returned 0x220000 [0215.257] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x221ab0 | out: hHeap=0x220000) returned 1 [0215.257] LocalFree (hMem=0x2397e0) returned 0x0 [0215.257] GetProcessHeap () returned 0x220000 [0215.257] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23aa10 | out: hHeap=0x220000) returned 1 [0215.257] _vsnwprintf (in: _Buffer=0x49e36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1bf2d8 | out: _Buffer="\r\n") returned 2 [0215.257] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.257] GetFileType (hFile=0x294) returned 0x3 [0215.257] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.257] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0215.257] WriteFile (in: hFile=0x294, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1bf2a8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1bf2a8*=0x2, lpOverlapped=0x0) returned 1 [0215.257] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0215.257] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e2c0a0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0215.257] _vsnwprintf (in: _Buffer=0x49e1eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1bf2e8 | out: _Buffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0215.257] _vsnwprintf (in: _Buffer=0x49e1eba8, _BufferCount=0x3da, _Format="%c", _ArgList=0x1bf2e8 | out: _Buffer=">") returned 1 [0215.257] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.257] GetFileType (hFile=0x294) returned 0x3 [0215.257] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.257] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp>", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp>", lpUsedDefaultChar=0x0) returned 38 [0215.258] WriteFile (in: hFile=0x294, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x1bf2d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1bf2d8*=0x25, lpOverlapped=0x0) returned 1 [0215.258] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.258] GetFileType (hFile=0x284) returned 0x3 [0215.258] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.258] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.258] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0215.258] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.258] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.258] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0215.258] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.258] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.258] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0215.258] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.258] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.258] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0215.258] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.258] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.258] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0215.259] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.259] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.259] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0215.259] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.259] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.259] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0215.259] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.259] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.259] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0215.259] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.259] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.259] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.259] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.259] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.259] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0215.259] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.259] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.259] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.259] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.259] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.259] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0215.260] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.260] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.260] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.260] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.260] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.260] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.260] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.260] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0215.260] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.260] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.260] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.260] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.260] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.260] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.260] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.260] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.260] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.260] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.260] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.260] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0215.260] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.260] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.260] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.260] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0215.260] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.260] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.260] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.260] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0215.261] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.261] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.261] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.261] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0215.261] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.261] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.261] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.261] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0215.261] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.261] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.261] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.261] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0215.261] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.261] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.261] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.261] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0215.261] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.261] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.261] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.261] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.261] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.261] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.261] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.261] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0215.261] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.261] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.261] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.261] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0215.261] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.262] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.262] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0215.262] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.262] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.262] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0215.262] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.262] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.262] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.262] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.262] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.262] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0215.262] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.262] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.262] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0215.262] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.262] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.262] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0215.262] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.262] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.262] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0215.262] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.263] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.263] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.263] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.263] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.263] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0215.263] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.263] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.263] ReadFile (in: hFile=0x284, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1bf5d8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1bf5d8*=0x1, lpOverlapped=0x0) returned 1 [0215.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0215.264] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.264] GetFileType (hFile=0x284) returned 0x3 [0215.264] _get_osfhandle (_FileHandle=0) returned 0x284 [0215.264] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.264] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.264] GetFileType (hFile=0x294) returned 0x3 [0215.264] _get_osfhandle (_FileHandle=1) returned 0x294 [0215.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0215.264] WriteFile (in: hFile=0x294, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1bf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1bf5b8*=0x24, lpOverlapped=0x0) returned 1 [0215.264] GetProcessHeap () returned 0x220000 [0215.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x4012) returned 0x23cd20 [0215.264] GetProcessHeap () returned 0x220000 [0215.264] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20 | out: hHeap=0x220000) returned 1 [0215.264] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0215.265] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0215.265] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0215.265] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0215.265] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0215.265] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0215.265] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0215.265] GetProcessHeap () returned 0x220000 [0215.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb0) returned 0x2397e0 [0215.265] GetProcessHeap () returned 0x220000 [0215.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x22) returned 0x234610 [0215.265] GetProcessHeap () returned 0x220000 [0215.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x48) returned 0x2398a0 [0215.266] GetConsoleOutputCP () returned 0x1b5 [0215.266] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e2bfe0 | out: lpCPInfo=0x49e2bfe0) returned 1 [0215.266] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0215.266] GetConsoleTitleW (in: lpConsoleTitle=0x1bf570, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0215.267] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0215.267] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0215.267] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0215.267] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0215.267] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0215.267] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0215.267] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0215.267] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0215.267] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0215.267] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0215.267] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0215.267] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0215.267] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0215.267] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0215.267] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0215.267] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0215.267] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0215.267] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0215.267] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0215.267] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0215.267] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0215.267] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0215.267] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0215.267] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0215.267] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0215.267] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0215.267] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0215.267] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0215.267] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0215.267] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0215.267] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0215.267] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0215.267] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0215.267] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0215.267] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0215.268] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0215.268] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0215.268] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0215.268] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0215.268] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0215.268] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0215.268] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0215.268] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0215.268] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0215.268] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0215.268] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0215.268] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0215.268] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0215.268] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0215.268] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0215.268] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0215.268] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0215.268] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0215.268] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0215.268] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0215.268] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0215.268] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0215.268] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0215.268] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0215.268] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0215.268] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0215.268] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0215.268] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0215.268] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0215.268] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0215.268] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0215.268] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0215.268] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0215.268] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0215.268] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0215.268] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0215.268] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0215.268] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0215.269] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0215.269] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0215.269] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0215.269] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0215.269] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0215.269] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0215.269] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0215.269] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0215.269] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0215.269] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0215.269] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0215.269] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0215.269] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0215.269] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0215.269] GetProcessHeap () returned 0x220000 [0215.269] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x218) returned 0x221ab0 [0215.269] GetProcessHeap () returned 0x220000 [0215.269] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x5a) returned 0x221cd0 [0215.269] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0215.270] GetProcessHeap () returned 0x220000 [0215.270] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x420) returned 0x239a80 [0215.270] SetErrorMode (uMode=0x0) returned 0x8001 [0215.270] SetErrorMode (uMode=0x1) returned 0x0 [0215.270] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x239a90, lpFilePart=0x1bee00 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFilePart=0x1bee00*="Temp") returned 0x24 [0215.270] SetErrorMode (uMode=0x8001) returned 0x1 [0215.270] GetProcessHeap () returned 0x220000 [0215.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x239a80, Size=0x6c) returned 0x239a80 [0215.270] GetProcessHeap () returned 0x220000 [0215.270] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x239a80) returned 0x6c [0215.270] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0215.270] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0215.270] GetProcessHeap () returned 0x220000 [0215.270] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x126) returned 0x235b70 [0215.270] GetProcessHeap () returned 0x220000 [0215.270] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x23c) returned 0x239b00 [0215.275] GetProcessHeap () returned 0x220000 [0215.275] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x239b00, Size=0x128) returned 0x239b00 [0215.275] GetProcessHeap () returned 0x220000 [0215.275] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x239b00) returned 0x128 [0215.275] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0215.275] GetProcessHeap () returned 0x220000 [0215.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xe8) returned 0x239c40 [0215.275] GetProcessHeap () returned 0x220000 [0215.275] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x239c40, Size=0x7e) returned 0x239c40 [0215.275] GetProcessHeap () returned 0x220000 [0215.275] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x239c40) returned 0x7e [0215.276] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0215.276] FindFirstFileExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1beb70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1beb70) returned 0xffffffffffffffff [0215.276] GetLastError () returned 0x2 [0215.277] FindFirstFileExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x1beb70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1beb70) returned 0xffffffffffffffff [0215.277] GetLastError () returned 0x2 [0215.277] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0215.277] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1beb70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1beb70) returned 0x221d40 [0215.277] GetProcessHeap () returned 0x220000 [0215.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x28) returned 0x234640 [0215.277] FindClose (in: hFindFile=0x221d40 | out: hFindFile=0x221d40) returned 1 [0215.277] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1beb70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1beb70) returned 0xffffffffffffffff [0215.277] GetLastError () returned 0x2 [0215.277] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1beb70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1beb70) returned 0x221d40 [0215.277] GetProcessHeap () returned 0x220000 [0215.277] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234640, Size=0x8) returned 0x2398f0 [0215.277] FindClose (in: hFindFile=0x221d40 | out: hFindFile=0x221d40) returned 1 [0215.277] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0215.277] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0215.277] GetConsoleTitleW (in: lpConsoleTitle=0x1bf0c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0215.278] GetProcessHeap () returned 0x220000 [0215.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x21c) returned 0x239cd0 [0215.278] GetConsoleTitleW (in: lpConsoleTitle=0x239ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0215.278] GetProcessHeap () returned 0x220000 [0215.278] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x239cd0, Size=0xc0) returned 0x239cd0 [0215.278] GetProcessHeap () returned 0x220000 [0215.278] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x239cd0) returned 0xc0 [0215.278] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0215.278] GetProcessHeap () returned 0x220000 [0215.278] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239cd0 | out: hHeap=0x220000) returned 1 [0215.278] InitializeProcThreadAttributeList (in: lpAttributeList=0x1bee78, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1bee38 | out: lpAttributeList=0x1bee78, lpSize=0x1bee38) returned 1 [0215.278] UpdateProcThreadAttribute (in: lpAttributeList=0x1bee78, dwFlags=0x0, Attribute=0x60001, lpValue=0x1bee28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1bee78, lpPreviousValue=0x0) returned 1 [0215.278] GetStartupInfoW (in: lpStartupInfo=0x1bef90 | out: lpStartupInfo=0x1bef90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x284, hStdOutput=0x294, hStdError=0x294)) [0215.278] GetProcessHeap () returned 0x220000 [0215.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x20) returned 0x234640 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0215.279] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0215.280] GetProcessHeap () returned 0x220000 [0215.280] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234640 | out: hHeap=0x220000) returned 1 [0215.280] GetProcessHeap () returned 0x220000 [0215.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x12) returned 0x238900 [0215.280] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpStartupInfo=0x1beeb0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1bee60 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1bee60*(hProcess=0x54, hThread=0x50, dwProcessId=0x320, dwThreadId=0x7b0)) returned 1 [0215.287] CloseHandle (hObject=0x50) returned 1 [0215.287] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0215.287] GetProcessHeap () returned 0x220000 [0215.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c230 | out: hHeap=0x220000) returned 1 [0215.287] GetEnvironmentStringsW () returned 0x23aa10* [0215.287] GetProcessHeap () returned 0x220000 [0215.287] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xae6) returned 0x23b500 [0215.287] FreeEnvironmentStringsW (penv=0x23aa10) returned 1 [0215.288] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0215.288] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0215.288] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1be768, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1be768, ReturnLength=0x0) returned 0x0 [0215.288] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1be7a0, nSize=0x380, lpNumberOfBytesRead=0x1be760 | out: lpBuffer=0x1be7a0*, lpNumberOfBytesRead=0x1be760*=0x380) returned 1 [0215.288] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3c59a000" os_pid = "0x780" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3b0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 60 os_tid = 0x240 [0215.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfcd0 | out: lpSystemTimeAsFileTime=0x1cfcd0*(dwLowDateTime=0x34675ec0, dwHighDateTime=0x1d52864)) [0215.157] GetCurrentProcessId () returned 0x780 [0215.157] GetCurrentThreadId () returned 0x240 [0215.157] GetTickCount () returned 0x426d1 [0215.157] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfcd8 | out: lpPerformanceCount=0x1cfcd8*=33527228088) returned 1 [0215.158] GetModuleHandleW (lpModuleName=0x0) returned 0x49df0000 [0215.158] __set_app_type (_Type=0x1) [0215.158] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e17810) returned 0x0 [0215.158] __getmainargs (in: _Argc=0x49e3a608, _Argv=0x49e3a618, _Env=0x49e3a610, _DoWildCard=0, _StartInfo=0x49e1e0f4 | out: _Argc=0x49e3a608, _Argv=0x49e3a618, _Env=0x49e3a610) returned 0 [0215.159] GetCurrentThreadId () returned 0x240 [0215.159] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x240) returned 0x3c [0215.159] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0215.159] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0215.159] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0215.160] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0215.160] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cfc68 | out: phkResult=0x1cfc68*=0x0) returned 0x2 [0215.160] VirtualQuery (in: lpAddress=0x1cfc50, lpBuffer=0x1cfbd0, dwLength=0x30 | out: lpBuffer=0x1cfbd0*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0215.160] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cfbd0, dwLength=0x30 | out: lpBuffer=0x1cfbd0*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0215.160] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cfbd0, dwLength=0x30 | out: lpBuffer=0x1cfbd0*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0215.160] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cfbd0, dwLength=0x30 | out: lpBuffer=0x1cfbd0*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0215.160] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cfbd0, dwLength=0x30 | out: lpBuffer=0x1cfbd0*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0215.160] GetConsoleOutputCP () returned 0x1b5 [0215.160] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e2bfe0 | out: lpCPInfo=0x49e2bfe0) returned 1 [0215.160] SetConsoleCtrlHandler (HandlerRoutine=0x49e13184, Add=1) returned 1 [0215.160] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.160] SetConsoleMode (hConsoleHandle=0x29c, dwMode=0x0) returned 0 [0215.161] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.161] GetConsoleMode (in: hConsoleHandle=0x29c, lpMode=0x49e1e194 | out: lpMode=0x49e1e194) returned 0 [0215.161] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.161] GetConsoleMode (in: hConsoleHandle=0x290, lpMode=0x49e1e198 | out: lpMode=0x49e1e198) returned 0 [0215.161] GetEnvironmentStringsW () returned 0x288a60* [0215.161] GetProcessHeap () returned 0x270000 [0215.161] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa7c) returned 0x2894f0 [0215.161] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0215.161] GetProcessHeap () returned 0x270000 [0215.161] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x8) returned 0x2888e0 [0215.161] GetEnvironmentStringsW () returned 0x288a60* [0215.161] GetProcessHeap () returned 0x270000 [0215.161] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa7c) returned 0x289f80 [0215.161] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0215.161] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ceb28 | out: phkResult=0x1ceb28*=0x44) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x0, lpData=0x1ceb40*=0x18, lpcbData=0x1ceb24*=0x1000) returned 0x2 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x4, lpData=0x1ceb40*=0x1, lpcbData=0x1ceb24*=0x4) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x0, lpData=0x1ceb40*=0x1, lpcbData=0x1ceb24*=0x1000) returned 0x2 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x4, lpData=0x1ceb40*=0x0, lpcbData=0x1ceb24*=0x4) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x4, lpData=0x1ceb40*=0x40, lpcbData=0x1ceb24*=0x4) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x4, lpData=0x1ceb40*=0x40, lpcbData=0x1ceb24*=0x4) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x0, lpData=0x1ceb40*=0x40, lpcbData=0x1ceb24*=0x1000) returned 0x2 [0215.162] RegCloseKey (hKey=0x44) returned 0x0 [0215.162] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ceb28 | out: phkResult=0x1ceb28*=0x44) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x0, lpData=0x1ceb40*=0x40, lpcbData=0x1ceb24*=0x1000) returned 0x2 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x4, lpData=0x1ceb40*=0x1, lpcbData=0x1ceb24*=0x4) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x0, lpData=0x1ceb40*=0x1, lpcbData=0x1ceb24*=0x1000) returned 0x2 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x4, lpData=0x1ceb40*=0x0, lpcbData=0x1ceb24*=0x4) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x4, lpData=0x1ceb40*=0x9, lpcbData=0x1ceb24*=0x4) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x4, lpData=0x1ceb40*=0x9, lpcbData=0x1ceb24*=0x4) returned 0x0 [0215.162] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ceb20, lpData=0x1ceb40, lpcbData=0x1ceb24*=0x1000 | out: lpType=0x1ceb20*=0x0, lpData=0x1ceb40*=0x9, lpcbData=0x1ceb24*=0x1000) returned 0x2 [0215.162] RegCloseKey (hKey=0x44) returned 0x0 [0215.162] time (in: timer=0x0 | out: timer=0x0) returned 0x5d0d2a53 [0215.162] srand (_Seed=0x5d0d2a53) [0215.162] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0215.162] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0215.163] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e2c0a0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0215.163] GetProcessHeap () returned 0x270000 [0215.163] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aa10 [0215.163] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0215.163] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0215.163] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0215.163] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0215.163] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0215.163] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0215.163] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0215.163] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0215.163] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0215.163] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0215.163] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0215.163] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0215.163] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0215.163] GetProcessHeap () returned 0x270000 [0215.163] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2894f0 | out: hHeap=0x270000) returned 1 [0215.163] GetEnvironmentStringsW () returned 0x288a60* [0215.163] GetProcessHeap () returned 0x270000 [0215.163] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa94) returned 0x28ac30 [0215.164] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0215.164] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0215.164] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0215.164] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0215.164] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0215.164] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0215.164] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0215.164] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0215.164] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0215.164] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0215.164] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0215.164] GetProcessHeap () returned 0x270000 [0215.164] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x5a) returned 0x28b6d0 [0215.164] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf930 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0215.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", nBufferLength=0x104, lpBuffer=0x1cf930, lpFilePart=0x1cf910 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFilePart=0x1cf910*="Temp") returned 0x24 [0215.164] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0215.164] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf640 | out: lpFindFileData=0x1cf640*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x28b740 [0215.164] FindClose (in: hFindFile=0x28b740 | out: hFindFile=0x28b740) returned 1 [0215.164] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1", lpFindFileData=0x1cf640 | out: lpFindFileData=0x1cf640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x28b740 [0215.164] FindClose (in: hFindFile=0x28b740 | out: hFindFile=0x28b740) returned 1 [0215.165] _wcsnicmp (_String1="5P5NRG~1", _String2="5P5NRG~1", _MaxCount=0x8) returned 0 [0215.165] _wcsicmp (_String1="5p5NrGJn0jS HALPmcxz", _String2="5P5NRG~1") returned -20 [0215.165] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData", lpFindFileData=0x1cf640 | out: lpFindFileData=0x1cf640*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="AppData", cAlternateFileName="")) returned 0x28b740 [0215.165] FindClose (in: hFindFile=0x28b740 | out: hFindFile=0x28b740) returned 1 [0215.165] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local", lpFindFileData=0x1cf640 | out: lpFindFileData=0x1cf640*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x344ace40, ftLastAccessTime.dwHighDateTime=0x1d52864, ftLastWriteTime.dwLowDateTime=0x344ace40, ftLastWriteTime.dwHighDateTime=0x1d52864, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Local", cAlternateFileName="")) returned 0x28b740 [0215.165] FindClose (in: hFindFile=0x28b740 | out: hFindFile=0x28b740) returned 1 [0215.166] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFindFileData=0x1cf640 | out: lpFindFileData=0x1cf640*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x32f40840, ftLastAccessTime.dwHighDateTime=0x1d52864, ftLastWriteTime.dwLowDateTime=0x32f40840, ftLastWriteTime.dwHighDateTime=0x1d52864, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Temp", cAlternateFileName="")) returned 0x28b740 [0215.166] FindClose (in: hFindFile=0x28b740 | out: hFindFile=0x28b740) returned 1 [0215.166] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0215.166] SetCurrentDirectoryW (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 1 [0215.166] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 1 [0215.166] GetProcessHeap () returned 0x270000 [0215.166] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ac30 | out: hHeap=0x270000) returned 1 [0215.166] GetEnvironmentStringsW () returned 0x28b740* [0215.166] GetProcessHeap () returned 0x270000 [0215.166] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xae6) returned 0x28c230 [0215.166] FreeEnvironmentStringsW (penv=0x28b740) returned 1 [0215.166] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e2c0a0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0215.166] GetProcessHeap () returned 0x270000 [0215.166] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b6d0 | out: hHeap=0x270000) returned 1 [0215.166] GetProcessHeap () returned 0x270000 [0215.166] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4016) returned 0x28cd20 [0215.167] GetProcessHeap () returned 0x270000 [0215.167] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd20 | out: hHeap=0x270000) returned 1 [0215.167] GetConsoleOutputCP () returned 0x1b5 [0215.167] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e2bfe0 | out: lpCPInfo=0x49e2bfe0) returned 1 [0215.167] GetUserDefaultLCID () returned 0x409 [0215.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e27b50, cchData=8 | out: lpLCData=":") returned 2 [0215.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cfa40, cchData=128 | out: lpLCData="0") returned 2 [0215.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cfa40, cchData=128 | out: lpLCData="0") returned 2 [0215.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cfa40, cchData=128 | out: lpLCData="1") returned 2 [0215.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e3a740, cchData=8 | out: lpLCData="/") returned 2 [0215.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e3a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0215.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e3a460, cchData=32 | out: lpLCData="Tue") returned 4 [0215.168] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e3a420, cchData=32 | out: lpLCData="Wed") returned 4 [0215.168] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e3a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0215.168] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e3a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0215.168] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e3a360, cchData=32 | out: lpLCData="Sat") returned 4 [0215.168] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e3a700, cchData=32 | out: lpLCData="Sun") returned 4 [0215.168] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e27b40, cchData=8 | out: lpLCData=".") returned 2 [0215.168] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e3a4e0, cchData=8 | out: lpLCData=",") returned 2 [0215.168] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0215.168] GetProcessHeap () returned 0x270000 [0215.168] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20c) returned 0x2895c0 [0215.169] GetConsoleTitleW (in: lpConsoleTitle=0x2895c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0215.213] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.213] GetFileType (hFile=0x29c) returned 0x3 [0215.213] BrandingFormatString () returned 0x2897e0 [0215.218] GetVersion () returned 0x1db10106 [0215.218] _vsnwprintf (in: _Buffer=0x1cfbb0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1cfb48 | out: _Buffer="6.1.7601") returned 8 [0215.218] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.218] GetFileType (hFile=0x29c) returned 0x3 [0215.218] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49e36340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0215.218] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49e36340, nSize=0x2000, Arguments=0x1cfb50 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0215.218] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.218] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0215.218] WriteFile (in: hFile=0x29c, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1cfad8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1cfad8*=0x24, lpOverlapped=0x0) returned 1 [0215.218] _vsnwprintf (in: _Buffer=0x49e36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cfb78 | out: _Buffer="\r\n") returned 2 [0215.218] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.219] GetFileType (hFile=0x29c) returned 0x3 [0215.219] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.219] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0215.219] WriteFile (in: hFile=0x29c, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cfb48, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1cfb48*=0x2, lpOverlapped=0x0) returned 1 [0215.219] _vsnwprintf (in: _Buffer=0x49e36340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1cfb78 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0215.219] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.219] GetFileType (hFile=0x29c) returned 0x3 [0215.219] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.219] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0215.219] WriteFile (in: hFile=0x29c, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1cfb48, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1cfb48*=0x3f, lpOverlapped=0x0) returned 1 [0215.219] _vsnwprintf (in: _Buffer=0x49e36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cfb78 | out: _Buffer="\r\n") returned 2 [0215.219] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.219] GetFileType (hFile=0x29c) returned 0x3 [0215.219] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.219] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0215.219] WriteFile (in: hFile=0x29c, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cfb48, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1cfb48*=0x2, lpOverlapped=0x0) returned 1 [0215.219] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0215.219] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0215.219] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0215.219] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0215.219] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.219] GetFileType (hFile=0x290) returned 0x3 [0215.219] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0215.220] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1cf9a0 | out: TokenHandle=0x1cf9a0*=0x0) returned 0xc000007c [0215.220] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1cf9a0 | out: TokenHandle=0x1cf9a0*=0x50) returned 0x0 [0215.220] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1cf9b0, TokenInformationLength=0x4, ReturnLength=0x1cf9b8 | out: TokenInformation=0x1cf9b0, ReturnLength=0x1cf9b8) returned 0x0 [0215.220] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1cf9b8, TokenInformationLength=0x4, ReturnLength=0x1cf9b0 | out: TokenInformation=0x1cf9b8, ReturnLength=0x1cf9b0) returned 0x0 [0215.220] NtClose (Handle=0x50) returned 0x0 [0215.220] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1cf980, nSize=0x0, Arguments=0x1cf988 | out: lpBuffer="\x97e0\x28") returned 0xf [0215.220] GetProcessHeap () returned 0x270000 [0215.220] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x271ab0 [0215.220] GetConsoleTitleW (in: lpConsoleTitle=0x1cf9d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0215.221] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0215.221] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0215.221] GetProcessHeap () returned 0x270000 [0215.221] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271ab0 | out: hHeap=0x270000) returned 1 [0215.221] LocalFree (hMem=0x2897e0) returned 0x0 [0215.221] GetProcessHeap () returned 0x270000 [0215.221] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aa10 | out: hHeap=0x270000) returned 1 [0215.222] _vsnwprintf (in: _Buffer=0x49e36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf6b8 | out: _Buffer="\r\n") returned 2 [0215.222] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.222] GetFileType (hFile=0x29c) returned 0x3 [0215.222] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.222] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0215.222] WriteFile (in: hFile=0x29c, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf688, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1cf688*=0x2, lpOverlapped=0x0) returned 1 [0215.222] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0215.222] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e2c0a0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0215.222] _vsnwprintf (in: _Buffer=0x49e1eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf6c8 | out: _Buffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0215.222] _vsnwprintf (in: _Buffer=0x49e1eba8, _BufferCount=0x3da, _Format="%c", _ArgList=0x1cf6c8 | out: _Buffer=">") returned 1 [0215.222] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.222] GetFileType (hFile=0x29c) returned 0x3 [0215.222] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.222] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp>", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp>", lpUsedDefaultChar=0x0) returned 38 [0215.222] WriteFile (in: hFile=0x29c, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x1cf6b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1cf6b8*=0x25, lpOverlapped=0x0) returned 1 [0215.222] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.222] GetFileType (hFile=0x290) returned 0x3 [0215.222] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.222] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.222] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.222] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e320, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0215.223] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.223] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.223] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e322, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.223] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.223] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.223] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e324, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0215.223] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.223] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.223] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e326, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0215.224] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.224] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.224] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e328, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0215.224] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.224] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.224] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.224] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.224] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.224] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e32c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0215.224] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.224] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.224] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e32e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0215.224] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.224] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.224] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e330, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0215.224] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.224] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.224] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e332, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0215.224] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.224] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.224] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e334, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0215.225] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.225] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.225] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e336, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0215.225] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.225] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.225] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.225] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.225] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.225] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e33a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0215.225] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.225] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.225] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e33c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0215.225] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.225] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.225] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e33e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0215.225] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.225] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.225] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e340, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0215.225] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.225] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.225] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e342, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.226] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.226] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.226] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e344, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0215.226] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.226] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.226] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e346, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.226] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.226] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.226] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e348, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0215.226] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.226] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.226] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e34a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.226] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.226] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.226] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e34c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0215.226] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.226] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.226] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e34e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0215.226] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.226] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.226] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e350, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0215.227] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.227] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.227] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e352, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0215.227] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.227] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.227] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e354, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.227] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.227] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.227] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e356, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0215.227] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.227] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.227] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e358, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0215.227] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.227] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.227] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e35a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0215.227] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.227] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.227] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e35c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0215.227] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.227] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.228] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e35e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0215.228] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.228] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.228] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e360, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0215.228] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.228] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.228] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e362, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0215.228] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.228] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.228] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e364, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0215.228] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.228] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.228] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e366, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.228] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.228] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.228] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e368, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.228] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.228] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.228] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e36a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0215.228] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.228] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.229] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0215.229] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.229] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.229] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e36e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0215.229] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.229] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.229] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e370, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0215.229] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.229] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.229] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e372, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0215.229] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.229] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.229] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e374, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0215.229] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.229] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.229] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e376, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0215.229] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.229] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.229] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e378, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0215.229] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.230] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.230] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e37a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0215.230] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.230] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.230] ReadFile (in: hFile=0x290, lpBuffer=0x49e2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesRead=0x1cf9b8*=0x1, lpOverlapped=0x0) returned 1 [0215.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e2c320, cbMultiByte=1, lpWideCharStr=0x49e2e37c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0215.231] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.231] GetFileType (hFile=0x290) returned 0x3 [0215.231] _get_osfhandle (_FileHandle=0) returned 0x290 [0215.231] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.231] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.231] GetFileType (hFile=0x29c) returned 0x3 [0215.231] _get_osfhandle (_FileHandle=1) returned 0x29c [0215.231] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x49e2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0215.231] WriteFile (in: hFile=0x29c, lpBuffer=0x49e2c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x1cf998, lpOverlapped=0x0 | out: lpBuffer=0x49e2c320*, lpNumberOfBytesWritten=0x1cf998*=0x2f, lpOverlapped=0x0) returned 1 [0215.231] GetProcessHeap () returned 0x270000 [0215.231] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x28cd20 [0215.231] GetProcessHeap () returned 0x270000 [0215.231] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd20 | out: hHeap=0x270000) returned 1 [0215.231] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0215.231] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0215.232] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0215.232] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0215.232] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0215.232] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0215.232] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0215.232] GetProcessHeap () returned 0x270000 [0215.232] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x2897e0 [0215.232] GetProcessHeap () returned 0x270000 [0215.232] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1c) returned 0x284610 [0215.232] GetProcessHeap () returned 0x270000 [0215.232] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x64) returned 0x2898a0 [0215.233] GetConsoleOutputCP () returned 0x1b5 [0215.233] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e2bfe0 | out: lpCPInfo=0x49e2bfe0) returned 1 [0215.233] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0215.233] GetConsoleTitleW (in: lpConsoleTitle=0x1cf950, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0215.234] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0215.234] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0215.234] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0215.234] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0215.234] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0215.234] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0215.234] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0215.234] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0215.234] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0215.234] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0215.234] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0215.234] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0215.234] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0215.234] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0215.234] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0215.234] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0215.234] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0215.234] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0215.234] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0215.234] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0215.234] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0215.234] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0215.234] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0215.234] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0215.234] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0215.234] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0215.234] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0215.234] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0215.234] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0215.234] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0215.235] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0215.235] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0215.235] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0215.235] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0215.235] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0215.235] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0215.235] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0215.235] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0215.235] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0215.235] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0215.235] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0215.235] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0215.235] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0215.235] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0215.235] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0215.235] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0215.235] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0215.235] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0215.235] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0215.235] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0215.235] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0215.235] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0215.235] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0215.235] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0215.235] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0215.235] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0215.235] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0215.235] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0215.235] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0215.235] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0215.235] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0215.235] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0215.235] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0215.235] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0215.235] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0215.235] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0215.235] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0215.235] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0215.236] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0215.236] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0215.236] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0215.236] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0215.236] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0215.236] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0215.236] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0215.236] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0215.236] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0215.236] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0215.236] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0215.236] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0215.236] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0215.236] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0215.236] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0215.236] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0215.236] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0215.236] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0215.236] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0215.236] GetProcessHeap () returned 0x270000 [0215.236] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x271ab0 [0215.236] GetProcessHeap () returned 0x270000 [0215.236] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x70) returned 0x271cd0 [0215.236] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0215.237] GetProcessHeap () returned 0x270000 [0215.237] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x289a80 [0215.237] SetErrorMode (uMode=0x0) returned 0x8001 [0215.237] SetErrorMode (uMode=0x1) returned 0x0 [0215.237] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x289a90, lpFilePart=0x1cf1e0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFilePart=0x1cf1e0*="Temp") returned 0x24 [0215.237] SetErrorMode (uMode=0x8001) returned 0x1 [0215.237] GetProcessHeap () returned 0x270000 [0215.237] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289a80, Size=0x66) returned 0x289a80 [0215.237] GetProcessHeap () returned 0x270000 [0215.237] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289a80) returned 0x66 [0215.237] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0215.237] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0215.237] GetProcessHeap () returned 0x270000 [0215.237] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x126) returned 0x285b70 [0215.237] GetProcessHeap () returned 0x270000 [0215.237] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x23c) returned 0x289b00 [0215.242] GetProcessHeap () returned 0x270000 [0215.242] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289b00, Size=0x128) returned 0x289b00 [0215.242] GetProcessHeap () returned 0x270000 [0215.242] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289b00) returned 0x128 [0215.242] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0215.242] GetProcessHeap () returned 0x270000 [0215.242] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x289c40 [0215.242] GetProcessHeap () returned 0x270000 [0215.242] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289c40, Size=0x7e) returned 0x289c40 [0215.242] GetProcessHeap () returned 0x270000 [0215.242] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289c40) returned 0x7e [0215.243] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0215.244] FindFirstFileExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1cef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cef50) returned 0xffffffffffffffff [0215.244] GetLastError () returned 0x2 [0215.244] FindFirstFileExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\netsh", fInfoLevelId=0x1, lpFindFileData=0x1cef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cef50) returned 0xffffffffffffffff [0215.244] GetLastError () returned 0x2 [0215.244] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0215.244] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1cef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cef50) returned 0x271d50 [0215.244] GetProcessHeap () returned 0x270000 [0215.244] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x28) returned 0x284640 [0215.244] FindClose (in: hFindFile=0x271d50 | out: hFindFile=0x271d50) returned 1 [0215.244] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x1cef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cef50) returned 0xffffffffffffffff [0215.244] GetLastError () returned 0x2 [0215.244] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x1cef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cef50) returned 0x271d50 [0215.244] GetProcessHeap () returned 0x270000 [0215.244] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284640, Size=0x8) returned 0x288900 [0215.244] FindClose (in: hFindFile=0x271d50 | out: hFindFile=0x271d50) returned 1 [0215.245] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0215.245] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0215.245] GetConsoleTitleW (in: lpConsoleTitle=0x1cf4a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0215.245] GetProcessHeap () returned 0x270000 [0215.245] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x289cd0 [0215.245] GetConsoleTitleW (in: lpConsoleTitle=0x289ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0215.245] GetProcessHeap () returned 0x270000 [0215.245] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289cd0, Size=0xd6) returned 0x289cd0 [0215.245] GetProcessHeap () returned 0x270000 [0215.245] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289cd0) returned 0xd6 [0215.245] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0215.246] GetProcessHeap () returned 0x270000 [0215.246] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289cd0 | out: hHeap=0x270000) returned 1 [0215.246] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cf258, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cf218 | out: lpAttributeList=0x1cf258, lpSize=0x1cf218) returned 1 [0215.246] UpdateProcThreadAttribute (in: lpAttributeList=0x1cf258, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cf208, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cf258, lpPreviousValue=0x0) returned 1 [0215.246] GetStartupInfoW (in: lpStartupInfo=0x1cf370 | out: lpStartupInfo=0x1cf370*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x290, hStdOutput=0x29c, hStdError=0x29c)) [0215.246] GetProcessHeap () returned 0x270000 [0215.246] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284640 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0215.246] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0215.247] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0215.247] GetProcessHeap () returned 0x270000 [0215.247] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284640 | out: hHeap=0x270000) returned 1 [0215.247] GetProcessHeap () returned 0x270000 [0215.247] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x285ca0 [0215.247] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpStartupInfo=0x1cf290*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cf240 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x1cf240*(hProcess=0x54, hThread=0x50, dwProcessId=0x7ac, dwThreadId=0x798)) returned 1 [0215.401] CloseHandle (hObject=0x50) returned 1 [0215.401] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0215.401] GetProcessHeap () returned 0x270000 [0215.401] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c230 | out: hHeap=0x270000) returned 1 [0215.401] GetEnvironmentStringsW () returned 0x28aa10* [0215.401] GetProcessHeap () returned 0x270000 [0215.401] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xae6) returned 0x28b500 [0215.401] FreeEnvironmentStringsW (penv=0x28aa10) returned 1 [0215.402] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0215.402] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0215.402] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1ceb48, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1ceb48, ReturnLength=0x0) returned 0x0 [0215.402] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1ceb80, nSize=0x380, lpNumberOfBytesRead=0x1ceb40 | out: lpBuffer=0x1ceb80*, lpNumberOfBytesRead=0x1ceb40*=0x380) returned 1 [0215.402] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "7" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x69130000" os_pid = "0x320" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x62c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 61 os_tid = 0x7b0 Thread: id = 63 os_tid = 0x64 Thread: id = 64 os_tid = 0x7b4 Thread: id = 65 os_tid = 0x5b8 Thread: id = 66 os_tid = 0x3d0 Process: id = "8" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x4de7b000" os_pid = "0x7ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x780" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0x798 [0215.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x17f7d0 | out: lpSystemTimeAsFileTime=0x17f7d0*(dwLowDateTime=0x349498e0, dwHighDateTime=0x1d52864)) [0215.741] GetCurrentProcessId () returned 0x7ac [0215.741] GetCurrentThreadId () returned 0x798 [0215.741] GetTickCount () returned 0x427f9 [0215.741] QueryPerformanceCounter (in: lpPerformanceCount=0x17f7d8 | out: lpPerformanceCount=0x17f7d8*=33585615324) returned 1 [0215.742] GetModuleHandleW (lpModuleName=0x0) returned 0x12b0000 [0215.742] __set_app_type (_Type=0x1) [0215.742] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x12bad14) returned 0x0 [0215.742] __wgetmainargs (in: _Argc=0x12c55c0, _Argv=0x12c55d0, _Env=0x12c55c8, _DoWildCard=0, _StartInfo=0x12c55dc | out: _Argc=0x12c55c0, _Argv=0x12c55d0, _Env=0x12c55c8) returned 0 [0215.743] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0215.743] GetModuleHandleW (lpModuleName=0x0) returned 0x12b0000 [0215.743] _vsnwprintf (in: _Buffer=0x12c7a40, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x177328 | out: _Buffer="netsh>") returned 6 [0215.743] GetProcessHeap () returned 0x2e0000 [0215.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3007d0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3007f0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300810 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300830 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300850 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300870 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3008c0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3008e0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300900 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300920 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300940 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300960 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300980 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3009a0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3009c0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3009e0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300a00 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300a20 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300a40 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300a60 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300a80 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300aa0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300ac0 [0215.744] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300ae0 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300b00 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300b20 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300b40 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300b60 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300b80 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300ba0 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300bc0 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300be0 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300c00 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300c20 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300c40 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300c60 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300c80 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300ca0 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300cc0 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300ce0 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300d00 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300d20 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300d40 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300d60 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300d80 [0215.745] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300da0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300dc0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300de0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300e00 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300e20 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300e40 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300e60 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300e80 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300ea0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300ec0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300ee0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300f00 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300f20 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300f40 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300f60 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300f80 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300fa0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300fc0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x300fe0 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301000 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301020 [0215.746] GetProcessHeap () returned 0x2e0000 [0215.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301040 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301060 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3010c0 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3010e0 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301100 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301120 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301140 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301160 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301180 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3011a0 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3011c0 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3011e0 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301200 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301220 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301240 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301260 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301280 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3012a0 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3012c0 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3012e0 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301300 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301320 [0215.747] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301340 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301360 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301380 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3013a0 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3013c0 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3013e0 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301400 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301420 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301440 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301460 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301480 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3014a0 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3014c0 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3014e0 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301500 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301520 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301540 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301560 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301580 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3015a0 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3015c0 [0215.748] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3015e0 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301600 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301620 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301640 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301660 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301680 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3016a0 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3016c0 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3016e0 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301700 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301720 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301740 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301760 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301780 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3017a0 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3017c0 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3017e0 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301800 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301820 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301840 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301860 [0215.749] GetProcessHeap () returned 0x2e0000 [0215.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3018c0 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3018e0 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301900 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301920 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301940 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301960 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301980 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3019a0 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3019c0 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3019e0 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301a00 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301a20 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301a40 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301a60 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301a80 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301aa0 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301ac0 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301ae0 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301b00 [0215.750] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301b20 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301b40 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301b60 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301b80 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301ba0 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301bc0 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301be0 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301c00 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301c20 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301c40 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301c60 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301c80 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301ca0 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301cc0 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301ce0 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301d00 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301d20 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301d40 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301d60 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301d80 [0215.751] GetProcessHeap () returned 0x2e0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301da0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301dc0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301de0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301e00 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301e20 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301e40 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301e60 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301e80 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301ea0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301ec0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301ee0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301f00 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301f20 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301f40 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301f60 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301f80 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301fa0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301fc0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x301fe0 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302000 [0215.752] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302020 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302040 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302060 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3020c0 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3020e0 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302100 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302120 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302140 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302160 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302180 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3021a0 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3021c0 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3021e0 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302200 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302220 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302240 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302260 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302280 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3022a0 [0215.753] GetProcessHeap () returned 0x2e0000 [0215.753] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3022c0 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3022e0 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x302300 [0215.754] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0215.754] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x28) returned 0x2fe060 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x2) returned 0x302890 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x302320 [0215.754] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2e0000) returned 1 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x58) returned 0x3028b0 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2e0000) returned 1 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xb0) returned 0x302910 [0215.754] GetProcessHeap () returned 0x2e0000 [0215.754] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3028b0 | out: hHeap=0x2e0000) returned 1 [0215.754] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x1772e8 | out: phkResult=0x1772e8*=0x90) returned 0x0 [0215.755] RegQueryInfoKeyW (in: hKey=0x90, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x177310, lpcbMaxValueNameLen=0x177320, lpcbMaxValueLen=0x177318, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x177310*=0x15, lpcbMaxValueNameLen=0x177320, lpcbMaxValueLen=0x177318, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0215.755] GetProcessHeap () returned 0x2e0000 [0215.755] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x16) returned 0x302340 [0215.755] GetProcessHeap () returned 0x2e0000 [0215.755] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x23) returned 0x2fe090 [0215.755] RegEnumValueW (in: hKey=0x90, dwIndex=0x0, lpValueName=0x302340, lpcchValueName=0x1772e0, lpReserved=0x0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328 | out: lpValueName="4", lpcchValueName=0x1772e0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328) returned 0x0 [0215.755] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0215.755] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0215.755] GetProcessHeap () returned 0x2e0000 [0215.755] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x50) returned 0x3028b0 [0215.755] GetProcessHeap () returned 0x2e0000 [0215.755] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x3029d0 [0215.755] GetProcessHeap () returned 0x2e0000 [0215.755] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x2fe0c0 [0215.755] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0215.755] GetProcessHeap () returned 0x2e0000 [0215.755] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fe060 | out: hHeap=0x2e0000) returned 1 [0215.755] LoadLibraryW (lpLibFileName="RASMONTR.DLL") returned 0x7fef43f0000 [0218.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x176ce0 | out: lpSystemTimeAsFileTime=0x176ce0*(dwLowDateTime=0x3550a580, dwHighDateTime=0x1d52864)) [0218.448] GetCurrentProcessId () returned 0x7ac [0218.449] GetCurrentThreadId () returned 0x798 [0218.450] GetTickCount () returned 0x42cca [0218.450] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x176ce8 | out: lpPerformanceCount=0x176ce8*=33856496889) returned 1 [0218.553] LoadLibraryA (lpLibFileName="MSVCRT.DLL") returned 0x7fefdad0000 [0218.581] GetVersion () returned 0x1db10106 [0218.584] SetErrorMode (uMode=0x0) returned 0x8001 [0218.592] SetErrorMode (uMode=0x8001) returned 0x0 [0218.636] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x304360 [0218.679] LocalFree (hMem=0x304360) returned 0x0 [0218.679] GetVersion () returned 0x1db10106 [0218.687] GlobalLock (hMem=0xb00008) returned 0x304360 [0218.690] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x304580 [0218.691] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x303080 [0218.691] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x302360 [0218.692] malloc (_Size=0x100) returned 0x547c80 [0218.692] __dllonexit () returned 0x7fef433621c [0218.698] __dllonexit () returned 0x7fef43366e0 [0218.707] __dllonexit () returned 0x7fef43372b8 [0218.707] __dllonexit () returned 0x7fef43387cc [0219.010] __dllonexit () returned 0x7fef4338d64 [0219.010] __dllonexit () returned 0x7fef4338db4 [0219.011] __dllonexit () returned 0x7fef4338e70 [0219.029] __dllonexit () returned 0x7fef433a308 [0219.030] __dllonexit () returned 0x7fef4338810 [0219.033] __dllonexit () returned 0x7fef4347598 [0219.033] __dllonexit () returned 0x7fef4338880 [0219.033] __dllonexit () returned 0x7fef433a170 [0219.034] __dllonexit () returned 0x7fef433a280 [0219.035] __dllonexit () returned 0x7fef433ad44 [0219.035] __dllonexit () returned 0x7fef433bc30 [0219.036] __dllonexit () returned 0x7fef433bc80 [0219.037] __dllonexit () returned 0x7fef433c338 [0219.039] __dllonexit () returned 0x7fef433d030 [0219.043] __dllonexit () returned 0x7fef43359cc [0219.043] __dllonexit () returned 0x7fef43359f0 [0219.043] __dllonexit () returned 0x7fef4335a1c [0219.044] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc0fd [0219.075] __dllonexit () returned 0x7fef4347568 [0219.075] __dllonexit () returned 0x7fef4347574 [0219.075] __dllonexit () returned 0x7fef4347580 [0219.075] __dllonexit () returned 0x7fef434758c [0219.076] GetVersion () returned 0x1db10106 [0219.076] GetVersion () returned 0x1db10106 [0219.076] GetVersion () returned 0x1db10106 [0219.076] __dllonexit () returned 0x7fef429a15c [0219.076] __dllonexit () returned 0x7fef42a6610 [0219.076] __dllonexit () returned 0x7fef4338910 [0219.076] __dllonexit () returned 0x7fef4338b90 [0219.076] __dllonexit () returned 0x7fef4338bb4 [0219.076] __dllonexit () returned 0x7fef42b6ae0 [0219.076] GetVersion () returned 0x1db10106 [0219.076] GetProcessVersion (ProcessId=0x0) returned 0x60001 [0219.078] GetSystemMetrics (nIndex=11) returned 32 [0219.078] GetSystemMetrics (nIndex=12) returned 32 [0219.078] GetSystemMetrics (nIndex=2) returned 17 [0219.078] GetSystemMetrics (nIndex=3) returned 17 [0219.078] GetDC (hWnd=0x0) returned 0xa01084e [0219.078] GetDeviceCaps (hdc=0xa01084e, index=88) returned 96 [0219.078] GetDeviceCaps (hdc=0xa01084e, index=90) returned 96 [0219.078] ReleaseDC (hWnd=0x0, hDC=0xa01084e) returned 1 [0219.078] GetSysColor (nIndex=15) returned 0xf0f0f0 [0219.078] GetSysColor (nIndex=16) returned 0xa0a0a0 [0219.078] GetSysColor (nIndex=20) returned 0xffffff [0219.078] GetSysColor (nIndex=18) returned 0x0 [0219.078] GetSysColor (nIndex=6) returned 0x646464 [0219.079] GetSysColorBrush (nIndex=15) returned 0x1100059 [0219.079] GetSysColorBrush (nIndex=6) returned 0x1100061 [0219.079] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0219.079] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0219.079] __dllonexit () returned 0x7fef4338f84 [0219.079] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0fe [0219.081] __dllonexit () returned 0x7fef42c3990 [0219.081] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0219.084] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0219.084] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0219.084] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0219.084] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0219.084] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0219.084] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0219.084] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0219.084] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0219.084] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0219.084] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0b1 [0219.084] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0b7 [0219.084] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0fe [0219.084] __dllonexit () returned 0x7fef43475a4 [0219.085] __dllonexit () returned 0x7fef43475bc [0219.085] __dllonexit () returned 0x7fef43475c8 [0219.085] __dllonexit () returned 0x7fef43475d4 [0219.085] __dllonexit () returned 0x7fef43475e0 [0219.085] GetCursorPos (in: lpPoint=0x7fef43a26d8 | out: lpPoint=0x7fef43a26d8*(x=191, y=337)) returned 1 [0219.086] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x3048d0 [0219.086] LocalReAlloc (hMem=0x302360, uBytes=0x18, uFlags=0x2) returned 0x3049e0 [0219.086] GetCurrentThread () returned 0xfffffffffffffffe [0219.086] GetCurrentThreadId () returned 0x798 [0219.086] __dllonexit () returned 0x7fef433cfa4 [0219.086] SetErrorMode (uMode=0x0) returned 0x8001 [0219.086] SetErrorMode (uMode=0x8001) returned 0x0 [0219.086] GetModuleFileNameW (in: hModule=0x7fef4280000, lpFilename=0x1763d0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0219.086] wcscpy_s (in: _Destination=0x1765e0, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0219.106] FindResourceW (hModule=0x7fef4280000, lpName=0xe01, lpType=0x6) returned 0x2409b0 [0219.120] LoadStringW (in: hInstance=0x7fef4280000, uID=0xe000, lpBuffer=0x1767f0, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0219.121] wcscpy_s (in: _Destination=0x176404, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0219.121] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0220.369] malloc (_Size=0x80) returned 0x547eb0 [0220.374] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x304a00 [0220.381] GetSystemDirectoryA (in: lpBuffer=0x176a70, uSize=0x112 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0220.384] strcat_s (in: _Destination="C:\\Windows\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\Windows\\system32\\MFC42") returned 0x0 [0220.385] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\Windows\\system32\\MFC42LOC") returned 0x0 [0220.385] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\Windows\\system32\\MFC42LOC.DLL") returned 0x0 [0220.386] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0220.695] GetProcAddress (hModule=0x7fef43f0000, lpProcName="InitHelperDll") returned 0x7fef440cf70 [0220.705] InitHelperDll () returned 0x0 [0220.705] RegisterHelper () returned 0x0 [0220.705] GetProcessHeap () returned 0x2e0000 [0220.705] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x108) returned 0x306b10 [0220.705] GetProcessHeap () returned 0x2e0000 [0220.705] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x302910 | out: hHeap=0x2e0000) returned 1 [0221.078] RegisterHelper () returned 0x0 [0221.078] GetProcessHeap () returned 0x2e0000 [0221.078] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x160) returned 0x306c20 [0221.078] GetProcessHeap () returned 0x2e0000 [0221.078] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x306b10 | out: hHeap=0x2e0000) returned 1 [0221.078] RegisterHelper () returned 0x0 [0221.078] GetProcessHeap () returned 0x2e0000 [0221.078] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1b8) returned 0x306d90 [0221.078] GetProcessHeap () returned 0x2e0000 [0221.078] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x306c20 | out: hHeap=0x2e0000) returned 1 [0221.078] RegisterHelper () returned 0x0 [0221.078] GetProcessHeap () returned 0x2e0000 [0221.078] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x210) returned 0x306b10 [0221.078] GetProcessHeap () returned 0x2e0000 [0221.078] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x306d90 | out: hHeap=0x2e0000) returned 1 [0221.079] RegisterHelper () returned 0x0 [0221.079] GetProcessHeap () returned 0x2e0000 [0221.079] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x268) returned 0x306d30 [0221.079] GetProcessHeap () returned 0x2e0000 [0221.079] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x306b10 | out: hHeap=0x2e0000) returned 1 [0221.079] RegEnumValueW (in: hKey=0x90, dwIndex=0x1, lpValueName=0x302340, lpcchValueName=0x1772e0, lpReserved=0x0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328 | out: lpValueName="nshwfp", lpcchValueName=0x1772e0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328) returned 0x0 [0221.079] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0221.079] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0221.079] GetProcessHeap () returned 0x2e0000 [0221.079] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x78) returned 0x302910 [0221.079] GetProcessHeap () returned 0x2e0000 [0221.079] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x302360 [0221.079] GetProcessHeap () returned 0x2e0000 [0221.079] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x16) returned 0x302380 [0221.079] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0221.079] GetProcessHeap () returned 0x2e0000 [0221.079] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3028b0 | out: hHeap=0x2e0000) returned 1 [0221.079] LoadLibraryW (lpLibFileName="NSHWFP.DLL") returned 0x7fef2940000 [0223.806] GetProcAddress (hModule=0x7fef2940000, lpProcName="InitHelperDll") returned 0x7fef29ab6d0 [0223.806] InitHelperDll () returned 0x0 [0224.305] RegisterHelper () returned 0x0 [0224.305] GetProcessHeap () returned 0x2e0000 [0224.308] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x2c0) returned 0x310ed0 [0224.328] GetProcessHeap () returned 0x2e0000 [0224.329] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x306d30 | out: hHeap=0x2e0000) returned 1 [0224.332] RegEnumValueW (in: hKey=0x90, dwIndex=0x2, lpValueName=0x302340, lpcchValueName=0x1772e0, lpReserved=0x0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328 | out: lpValueName="dhcpclient", lpcchValueName=0x1772e0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328) returned 0x0 [0224.332] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0224.332] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0224.332] GetProcessHeap () returned 0x2e0000 [0224.332] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa0) returned 0x306d30 [0224.332] GetProcessHeap () returned 0x2e0000 [0224.332] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x16) returned 0x3023a0 [0224.332] GetProcessHeap () returned 0x2e0000 [0224.332] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x22) returned 0x307360 [0224.332] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0224.332] GetProcessHeap () returned 0x2e0000 [0224.332] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x302910 | out: hHeap=0x2e0000) returned 1 [0224.332] LoadLibraryW (lpLibFileName="DHCPCMONITOR.DLL") returned 0x7fef4250000 [0230.449] GetProcAddress (hModule=0x7fef4250000, lpProcName="InitHelperDll") returned 0x7fef4251a40 [0230.449] InitHelperDll () returned 0x0 [0230.449] RegisterHelper () returned 0x0 [0230.449] GetProcessHeap () returned 0x2e0000 [0230.449] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x318) returned 0x315e60 [0230.449] GetProcessHeap () returned 0x2e0000 [0230.449] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x310ed0 | out: hHeap=0x2e0000) returned 1 [0230.449] RegEnumValueW (in: hKey=0x90, dwIndex=0x3, lpValueName=0x302340, lpcchValueName=0x1772e0, lpReserved=0x0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328 | out: lpValueName="wshelper", lpcchValueName=0x1772e0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328) returned 0x0 [0230.449] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0230.449] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0230.449] GetProcessHeap () returned 0x2e0000 [0230.449] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc8) returned 0x310ed0 [0230.449] GetProcessHeap () returned 0x2e0000 [0230.449] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12) returned 0x313610 [0230.449] GetProcessHeap () returned 0x2e0000 [0230.449] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x311620 [0230.449] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0230.450] GetProcessHeap () returned 0x2e0000 [0230.450] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x306d30 | out: hHeap=0x2e0000) returned 1 [0230.450] LoadLibraryW (lpLibFileName="WSHELPER.DLL") returned 0x7fef4220000 [0231.578] GetProcAddress (hModule=0x7fef4220000, lpProcName="InitHelperDll") returned 0x7fef4221720 [0231.578] InitHelperDll () returned 0x0 [0231.590] RegisterHelper () returned 0x0 [0231.590] GetProcessHeap () returned 0x2e0000 [0231.590] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x370) returned 0x316bd0 [0231.590] GetProcessHeap () returned 0x2e0000 [0231.590] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315e60 | out: hHeap=0x2e0000) returned 1 [0231.590] RegEnumValueW (in: hKey=0x90, dwIndex=0x4, lpValueName=0x302340, lpcchValueName=0x1772e0, lpReserved=0x0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328 | out: lpValueName="nshhttp", lpcchValueName=0x1772e0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328) returned 0x0 [0231.590] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0231.590] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0231.590] GetProcessHeap () returned 0x2e0000 [0231.590] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xf0) returned 0x315e60 [0231.590] GetProcessHeap () returned 0x2e0000 [0231.590] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x313630 [0231.590] GetProcessHeap () returned 0x2e0000 [0231.590] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x313650 [0231.590] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0231.590] GetProcessHeap () returned 0x2e0000 [0231.590] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x310ed0 | out: hHeap=0x2e0000) returned 1 [0231.590] LoadLibraryW (lpLibFileName="NSHHTTP.DLL") returned 0x7fef4210000 [0234.681] GetProcAddress (hModule=0x7fef4210000, lpProcName="InitHelperDll") returned 0x7fef4211c24 [0234.681] InitHelperDll () returned 0x0 [0234.681] RegisterHelper () returned 0x0 [0234.681] GetProcessHeap () returned 0x2e0000 [0234.681] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x3c8) returned 0x316f50 [0234.681] GetProcessHeap () returned 0x2e0000 [0234.681] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x316bd0 | out: hHeap=0x2e0000) returned 1 [0234.681] RegEnumValueW (in: hKey=0x90, dwIndex=0x5, lpValueName=0x302340, lpcchValueName=0x1772e0, lpReserved=0x0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328 | out: lpValueName="fwcfg", lpcchValueName=0x1772e0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328) returned 0x0 [0234.681] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0234.681] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0234.681] GetProcessHeap () returned 0x2e0000 [0234.681] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x118) returned 0x315f60 [0234.681] GetProcessHeap () returned 0x2e0000 [0234.681] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x313670 [0234.681] GetProcessHeap () returned 0x2e0000 [0234.681] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x313690 [0234.681] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0234.681] GetProcessHeap () returned 0x2e0000 [0234.681] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315e60 | out: hHeap=0x2e0000) returned 1 [0234.681] LoadLibraryW (lpLibFileName="FWCFG.DLL") returned 0x7fef41e0000 [0237.621] GetProcAddress (hModule=0x7fef41e0000, lpProcName="InitHelperDll") returned 0x7fef41e2d20 [0237.621] InitHelperDll () returned 0x0 [0237.621] RegisterHelper () returned 0x0 [0237.621] GetProcessHeap () returned 0x2e0000 [0237.621] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x420) returned 0x31b320 [0237.621] GetProcessHeap () returned 0x2e0000 [0237.621] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x316f50 | out: hHeap=0x2e0000) returned 1 [0237.621] RegEnumValueW (in: hKey=0x90, dwIndex=0x6, lpValueName=0x302340, lpcchValueName=0x1772e0, lpReserved=0x0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328 | out: lpValueName="authfwcfg", lpcchValueName=0x1772e0, lpType=0x0, lpData=0x2fe090, lpcbData=0x177328) returned 0x0 [0237.621] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0237.621] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0237.621] GetProcessHeap () returned 0x2e0000 [0237.621] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x140) returned 0x316bd0 [0237.621] GetProcessHeap () returned 0x2e0000 [0237.621] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x3136d0 [0237.621] GetProcessHeap () returned 0x2e0000 [0237.621] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1c) returned 0x316750 [0237.621] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0237.621] GetProcessHeap () returned 0x2e0000 [0237.621] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315f60 | out: hHeap=0x2e0000) returned 1 [0237.621] LoadLibraryW (lpLibFileName="AUTHFWCFG.DLL") returned 0x7fef28c0000 [0241.427] GetProcAddress (hModule=0x7fef28c0000, lpProcName="InitHelperDll") returned 0x7fef28c5d20 [0241.427] InitHelperDll () Process: id = "9" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x5f656000" os_pid = "0x8a8" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x320" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0009bdb2" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 67 os_tid = 0x8d0 Thread: id = 68 os_tid = 0x8cc Thread: id = 69 os_tid = 0x758 [0217.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf7daa0 | out: lpSystemTimeAsFileTime=0xf7daa0*(dwLowDateTime=0x34e32640, dwHighDateTime=0x1d52864)) [0217.733] GetCurrentProcessId () returned 0x8a8 [0217.733] GetCurrentThreadId () returned 0x758 [0217.733] GetTickCount () returned 0x429fc [0217.733] QueryPerformanceCounter (in: lpPerformanceCount=0xf7daa8 | out: lpPerformanceCount=0xf7daa8*=33784844798) returned 1 [0217.733] malloc (_Size=0x100) returned 0x6b8e80 Thread: id = 70 os_tid = 0x7c8 Thread: id = 71 os_tid = 0x7a4 Thread: id = 72 os_tid = 0x83c Thread: id = 73 os_tid = 0x914 Thread: id = 87 os_tid = 0x91c Thread: id = 105 os_tid = 0xa20 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x8a8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 74 os_tid = 0x210 Thread: id = 75 os_tid = 0x178 Thread: id = 76 os_tid = 0x41c Thread: id = 77 os_tid = 0xbcc Thread: id = 78 os_tid = 0x9e8 Thread: id = 79 os_tid = 0x8a0 Thread: id = 80 os_tid = 0x76c Thread: id = 81 os_tid = 0x72c Thread: id = 82 os_tid = 0x71c Thread: id = 83 os_tid = 0x718 Thread: id = 84 os_tid = 0x154 Thread: id = 85 os_tid = 0x120 Thread: id = 86 os_tid = 0x3fc Thread: id = 106 os_tid = 0x5b4 Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5ff6c000" os_pid = "0x918" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x8a8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0009c1a6" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 88 os_tid = 0x910 Thread: id = 89 os_tid = 0x924 Thread: id = 90 os_tid = 0x928 Thread: id = 91 os_tid = 0x92c Thread: id = 92 os_tid = 0x33c Thread: id = 93 os_tid = 0x6a8 Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "10" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 107 os_tid = 0x6d0 Thread: id = 108 os_tid = 0x838 Thread: id = 109 os_tid = 0x8f4 Thread: id = 110 os_tid = 0x888 Thread: id = 111 os_tid = 0x754 Thread: id = 112 os_tid = 0x704 Thread: id = 113 os_tid = 0x6b0 Thread: id = 114 os_tid = 0x698 Thread: id = 115 os_tid = 0x678 Thread: id = 116 os_tid = 0x610 Thread: id = 117 os_tid = 0x14c Thread: id = 118 os_tid = 0x140 Thread: id = 119 os_tid = 0x158 Thread: id = 120 os_tid = 0x294 Thread: id = 121 os_tid = 0x21c Thread: id = 122 os_tid = 0x1c4 Process: id = "13" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8bed000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba6f" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 124 os_tid = 0x250 Thread: id = 125 os_tid = 0x414 Thread: id = 126 os_tid = 0x884 Thread: id = 127 os_tid = 0x658 Thread: id = 128 os_tid = 0x584 Thread: id = 129 os_tid = 0x728 Thread: id = 130 os_tid = 0x674 Thread: id = 131 os_tid = 0x65c Thread: id = 132 os_tid = 0x144 Thread: id = 133 os_tid = 0x118 Thread: id = 134 os_tid = 0x3ec Thread: id = 135 os_tid = 0x3e0 Thread: id = 136 os_tid = 0x3dc Thread: id = 137 os_tid = 0x3cc Thread: id = 138 os_tid = 0x3c8 Thread: id = 139 os_tid = 0x388 Thread: id = 140 os_tid = 0x380 Thread: id = 141 os_tid = 0x37c Thread: id = 142 os_tid = 0x364 Thread: id = 143 os_tid = 0x34c Thread: id = 144 os_tid = 0x338